The JetFormBuilder plugin for WordPress contains a missing authorization flaw that allows an attacker who can reach the form management endpoints to create, modify, or delete forms and the data submitted through them. This weakness is an Incorrect Authorization problem (CWE‑862), which can lead to loss of form configuration integrity, potential data exposure user input. The description confirms that the plugin fails to enforce proper access control, letting users without proper privileges exploit the issue.

The flaw affects the Crocoblock JetFormBuilder plugin, all releases from the first introduced version up through 3.6.6. Any WordPress installation that has this plugin installed and enabled is vulnerable.

The CVSS score of 7.5 indicates a high level of severity. The EPSS score of 0.0033 (0.33%) indicates an extremely low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be actively exploited in the wild. However, the attack vector involves typical web interaction – anyone able to access the site can trigger the vulnerable endpoints, meaning remote exploitation is feasible without additional privileges.