The Flamingo plugin for WordPress does not properly verify that a user is authorized before allowing access to WordPress core APIs. This flaw enables authenticated users with Contributor or higher roles to use the wp.getTerms method via XML‑RPC and the ajax‑tag‑search action to enumerate taxonomy terms. The returned data can include channel names derived from Contact Form 7 form titles, submission counts per channel, and contact tag names, revealing internal form purposes, department names, or workflow identifiers. The vulnerability is a classic case of authorization bypass through user‑controlled input, as identified by CWE‑862.

Any WordPress site that installs the Flamingo plugin and runs a version up to and including 2.6.2. The affected product is identified by the vendor rocklobsterinc under the Flamingo plugin family. Sites that combine Flamingo with Contact Form 7 and rely on its taxonomy mapping are particularly at risk.

The CVSS score of 5.4 places the flaw in the medium severity range. While no EPSS figure is available, the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be authenticated with a role of Contributor or higher; no privileged escalation is necessary. Exploitation is straightforward: an attacker can simply invoke the wp.getTerms XML‑RPC call or perform an AJAX tag search to retrieve unwanted internal data. Because the flaw originates from missing authorization checks, any user with Contributor access can carry out the attack without interacting directly with the plugin’s admin UI.