The Campaign Monitor for WordPress forms-for-campaign-monitor plugin contains a missing authorization vulnerability that allows attackers to exploit incorrectly configured access‑control security levels and bypass access controls, potentially accessing or altering restricted form data. This flaw is classified under CWE‑862, indicating that proper access‑control checks are not enforced.

Affected systems include any instance of the Campaign Monitor for WordPress plugin on WordPress sites running version 2.9.1 or earlier. The vulnerability applies to all installations up to and including 2.9.1, with the plugin’s full set of features available to unauthorized users.

The CVSS score associated with this issue is 4.3, indicating a moderate severity level. Exploit probability measured by EPSS is below 1%, implying a low likelihood of active exploitation in the wild. The vulnerability is not documented in the CISA KEV catalog. Attackers would most likely exploit this flaw remotely by accessing the plugin’s front‑end or administrative endpoints; however, the description does not detail the exact attack vector, so this assessment is inferred from typical plugin vulnerabilities.