Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugins for WordPress contain an authorization bypass that permits unauthenticated attackers to alter the read/unread status or permanently trash any form submission entry. The vulnerability arises because the nonce generated by check_ajax_referer() is emitted to all visitors via wp_localize_script() on public pages containing a Gutena Forms block, thus providing the attacker with the necessary token without user authentication. This flaw, classified as CWE‑862, can lead to loss of data integrity and potential exposure of sensitive form information, but does not provide code‑execution or broader system compromise.

All installations of the Gutena Forms plugin version 1.9.0 or earlier are affected. The plugin is developed by saadiqbal and is deployed on WordPress sites that use any of the plugin’s form components, including contact, survey, feedback, booking, and custom forms.

The CVSS base score of 5.3 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers can inject crafted bulk‑action requests via the public process_bulk_action() endpoint; the freely obtainable nonce eliminates the need for authentication. Consequently, the risk is moderate, but exposure probability remains low under current conditions.