The vulnerability in the Gutena Forms WordPress plugin allows a user with a contributor or higher role to modify any boolean or array option, such as users_can_register, without any validation. This unexpected capability can change site configuration and affect how the website behaves, potentially granting the attacker the ability to alter user registration, permission settings, and other core functionalities. The weakness is a role‑based access control flaw, identified as CWE‑639.

The issue affects the Gutena Forms plugin for WordPress on all versions prior to 1.6.1. The vendor is listed as Gutena Forms, and any installation of this plugin where a contributor or higher user is present is at risk. No further version details are provided beyond the 1.6.1 threshold.

The CVSS score of 6.8 signals a moderate risk, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Because the attacker requires an authenticated account with contributor or higher privileges, the attack vector is local and depends on existing internal access. An attacker could exploit the flaw by using the plugin’s settings interface to flip boolean switches or replace array options, thereby altering site behavior or escalating privileges.