This vulnerability is a missing authorization flaw that allows an attacker to tamper with the WordPress Contact Form by WPForms plugin’s settings. The flaw stems from incorrectly configured access control security levels, enabling unauthorized modification or retrieval of form data and configuration. The exploit can lead to data exposure or alteration of contact form behavior, directly compromising the confidentiality and integrity of data handled by the form.

Affected systems are installations of the Contact Form by WPForms plugin from the vendor Syed Balkhi. All releases from the earliest available version up to and including 1.9.9.3 are impacted. The plugin is distributed as wpforms-lite for WordPress.

The CVSS score of 4.3 reflects a medium severity level, while the EPSS score of less than 1% indicates a low exploit probability at this time. The vulnerability is not listed in CISA’s KEV catalog. The typical attack vector is inferred to be remote via the WordPress web interface, requiring no special credentials. However, such inference is drawn from the plugin’s web-based nature rather than explicit data in the description. Given the low scores but potential for unauthorized data modification, administrators should consider this a priority for remediation.