The vulnerability stems from a missing authorization check in the WP Cost Estimation & Payment Forms Builder plugin, allowing users with lower privileges than intended administrators to read, modify, or delete payment form data. This flaw is represented by CWE‑862 and can expose financial information and disrupt processes that rely on the integrity of the payment forms. The potential impact is limited to the data managed by the plugin but can result in significant loss of confidentiality and data integrity if an attacker leverages the exposed access.

All installations of the loopus WP Cost Estimation & Payment Forms Builder plugin with a version number earlier than 10.3.0 are affected. Sites that have deployed the plugin without strict role‑based access restrictions will be vulnerable to this flaw.

The CVSS score of 7.5 indicates a high potential impact, though the EPSS score of less than 1% suggests that exploitation is currently uncommon. The plugin is not listed in the CISA KEV catalog. The likely attack vector is web access to the WordPress site where an attacker can submit requests that bypass the intended role checks; this inference is based on the description of a missing authorization defect. If the site's configuration allows permissive access, the risk is high, but the absence of such permissive settings reduces the likelihood of exploitation.