Technical impact
This vulnerability is a broken access control flaw in the BoldGrid weForms WordPress plugin. The plugin fails to enforce proper authorization when accessing certain management functions, allowing an attacker with any authenticated user role to perform actions that should be restricted, such as modifying form configurations and potentially accessing sensitive data. The weakness aligns with CWE‑862, indicating an improper authorization failure that could lead to unauthorized data manipulation and exposure.
Affected Systems
BoldGrid weForms plugin versions from an unspecified initial release up to and including 1.6.25 are affected. Any WordPress site that has installed 1.6.25 or earlier of this plugin is potentially vulnerable. This includes users who have not upgraded beyond version 1.6.25.
Risk and Exploitability
Based on the CVSS score of 5.3, the issue carries moderate risk. The EPSS score of less than 1% indicates the exploit probability is low. It is not present in CISA KEV, meaning it has not been observed in widespread exploitation campaigns. The vulnerability likely requires the attacker to log into WordPress with any user role, and then access management endpoints that are improperly protected, allowing them to modify forms or gain unauthorized data. No advanced prerequisites or zero‑day exploits are needed; exploitation is straightforward once access to the site is available.
