The CRM Perks "Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms" plugin contains a missing authorization flaw (CWE‑862). The plugin fails to properly verify a user’s privileges before allowing access to certain configuration endpoints. As a result, an attacker who can reach those endpoints may read or modify the plugin’s settings, potentially redirecting form submissions, exposing connection credentials, or altering the behavior of integrated services.

WordPress sites that have installed the plugin in versions up to and including 1.2.2 are affected. The issue applies across the various form integration components – Mailchimp, WPForms, Elementor, and Ninja Forms – and is not limited to a particular form type or WordPress edition.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is submitting unauthorized HTTP requests to the plugin’s protected endpoints. Successful exploitation could result in unauthorized configuration changes, data exposure, or disruption of form processing.