baserCMS includes a public mail submission API that, before version 5.2.3, allowed users to submit mail form entries even when the target form was disabled. This flaw lets attackers send spam or abuse messages without needing a valid form identifier or any authentication, undermining the intended administrative controls.

The vulnerability affects all baserCMS versions prior to 5.2.3. Each release before 5.2.3 incorporates the vulnerable API. The issue was addressed in the 5.2.3 release.

The flaw has a CVSS score of 5.3, reflecting moderate severity, and an EPSS score below 1%, indicating low likelihood of exploitation. It is not listed in the KEV catalog, and no public exploit code is currently known. Nevertheless, because the API can be accessed by unauthenticated users, an attacker can abuse the system to send unsolicited mail, potentially creating spam or phishing content. The primary risk is to the integrity and availability of the mail service rather than to system privileges.