The vulnerability is a missing authorization error in the Ultimate Addons for Contact Form 7 plugin. It allows attackers to invoke administrative endpoints that should be protected, letting them modify form behavior and potentially extract or alter data collected through the contact forms. The weakness is the absence of permission checks before executing privileged actions, which could compromise the integrity of the form settings.

The plugin affected is Themefic Ultimate Addons for Contact Form 7, any version up to and including 3.5.34. All WordPress sites that have installed this plugin without upgrading beyond version 3.5.34 are potentially vulnerable.

The CVSS score of 5.3 indicates medium severity, while an EPSS score of <1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers who can send crafted HTTP requests to the plugin’s administrative endpoints—likely from a remote location—could exploit the missing authorization checks. This inference is based on the description that the flaw involves incorrectly configured access control level checks.