The vulnerability disrupts the plugin’s authorization controls, allowing bypass of checks that should restrict certain actions. The flaw is identified as a missing authorization weakness (CWE-862). The CVE description states that it enables exploitation of incorrectly configured access control security levels, but does not specify which operations are affected. Based on typical plugin functionality, it is inferred that an attacker could potentially read or modify form data or administrative settings, though the exact capabilities are not detailed in the CVE text.

Vulnerable versions are all releases of the WordPress Everest Forms plugin from the vendor Everest Forms up to and including 3.6.3. This applies to any installation of the plugin, regardless of the underlying WordPress version or hosting environment. Versions 3.6.4 and later are not affected.

The CVSS score of 4.3 indicates moderate severity; the EPSS score is not available, indicating no current evidence of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to involve payload delivery through crafted HTTP requests to the plugin’s backend endpoints, as is common for WordPress plugins. Because the CVE description does not declare a current exploitation record, the risk remains moderate but it poses a potential threat to data confidentiality and integrity if the flaw is exploited.