The Easy Form Builder plugin for WordPress contains a missing authorization check that allows an attacker to bypass access controls and perform operations such as creating, reading, or deleting form data. This flaw is classified as CWE-862 and can lead to unauthorized disclosure or modification of user input and related content.

The vulnerability applies to hassantafreshi Easy Form Builder version 3.9.6 and earlier. All users running this plugin on a WordPress site are potentially affected, as the issue spans all releases from the outset of the plugin up to and including 3.9.6.

The flaw carries a CVSS score of 8.8, indicating high severity, while the EPSS score is below 1%, suggesting a low chance of active exploitation at this time. The vulnerability is not listed in CISA's KEV catalog. The description indicates a missing authorization check, which could allow an attacker with access to the site to potentially perform operations such as creating, reading, or deleting form data without proper role verification. However, the specific attack path or required context is not detailed in the available CVE information.