Missing Authorization vulnerability in Automattic Crowdsignal Forms allows an attacker to exploit incorrectly configured access control levels. The flaw permits access to functionality intended for higher-privilege users, potentially enabling unauthorized form submission, data retrieval, or manipulation. This weakness is categorized as CWE‑862, indicating a failure to enforce proper authorization checks.

All WordPress sites that have the Crowdsignal Forms plugin installed at version 1.7.2 or older are affected. The issue is present in every release up to and including 1.7.2 and is reported to impact the Crowdsignal Forms plugin from its inception through the specified maximum version.

The CVSS score of 3.8 indicates a low overall severity, and the EPSS score of less than 1% shows a very small likelihood of exploitation in the wild. It is not currently listed in the CISA KEV catalog. The attack vector is inferred to be through the plugin’s administrative and frontend interfaces; an attacker with access to a logged‑in user account that lacks sufficient permissions could manipulate form creation or access. No additional exploitation prerequisites are documented, so the risk remains limited but non‑zero.