Missing authorization in the Contact Form Email plugin allows an attacker to exploit incorrectly configured access control levels. The vulnerability can enable unauthorized users to perform privileged actions within the plugin, which may lead to the disclosure of personal data submitted through contact forms or the manipulation of form behavior. It is classified under CWE-862 and receives a CVSS score of 6.5, indicating a moderate severity risk.

The affected product is the codepeople Contact Form Email WordPress plugin, version 1.3.58 and all earlier releases. WordPress sites running any version up to 1.3.58 are impacted unless the plugin has been updated, removed, or the access controls have been manually hardened.

The EPSS score is less than 1%, indicating a low exploitation probability at the present time, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, attackers may target this flaw through the web interface or exposed administrative URLs, leveraging the missing authorization checks. Because the CVSS score is 6.5, the risk is moderate but should not be ignored, especially on publicly accessible sites that still use the vulnerable plugin version.