The vulnerability is a missing authorization check that allows any authenticated user to invoke privileged functions within the Easy Form plugin. As a result, an attacker can create, modify, or delete forms and view submissions that are intended for administrators only. The weakness is categorized as a classic access‑control flaw, identified as CWE‑862, and directly threatens the confidentiality and integrity of sensitive form data.

WordPress sites running the Ays Pro Easy Form plugin from the earliest supported revision up through version 2.7.8 are affected. Site administrators should verify the installed plugin version and consider updating or disabling the plugin if it is not required.

The CVSS score of 7.5 places the issue in the high severity range, while the EPSS score of less than 1% indicates that exploitation is currently unlikely to be common. However, the flaw is not yet listed in CISA KEV. The likely attack vector is remote exploitation via the plugin’s HTTP API, which an attacker can reach from any external host. Because the problem relies on missing authorization, an attacker with network access to the WordPress site can send crafted requests to privileged endpoints and gain unauthorized control over form creation, modification, and data access.