The vulnerability is a missing authorization flaw that allows an attacker to bypass configured access control levels in the WordPress Contact Form by Supsystic plugin. Because the plugin fails to enforce the intended restrictions, an attacker could potentially submit forms, alter submission data, or otherwise exploit user input without proper permission. This flaw is classified as CWE-862. The impact is limited to the scope of the plugin's permissions and does not provide direct remote code execution or broader system compromise.

Supsystic’s Contact Form by Supsystic plugin versions from the initial release through 1.10.7 are affected. Users of WordPress sites who have installed or enabled this plugin, or who have not upgraded past 1.10.7, are at risk.

The CVSS score of 5.3 indicates medium severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the plugin’s publicly accessible form interface, where an unauthenticated or unauthorized user could send crafted requests to trigger the broken access control. Exploitation does not require special credentials beyond those normally required to interact with the form, making this a potentially low‑effort threat that could be leveraged in targeted or mass‑submission scenarios.