The vulnerability is an IDOR that enables a user-controlled key to bypass authorization and access or modify objects belonging to other users. This can compromise the confidentiality or integrity of data handled by the plugin. It is classified as CWE‑639 and carries a CVSS score of 5.3, indicating moderate severity.

The plugin affected is CrocoBlock’s JetFormBuilder – Hierarchical Select, version 1.0.10 and earlier. Any WordPress site that installs this plugin before version 1.0.11 is vulnerable, regardless of site size or configuration.

EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, so the exploitation probability is unknown. The likely attack vector involves an authenticated or unauthenticated user navigating plugin URLs where object identifiers are exposed and can be manipulated. Despite the lack of disclosed exploits, the moderate CVSS score and the nature of IDOR warrant timely remediation.