The vulnerability in Contact Form Email is a missing authorization check that permits unauthorized users to access or manipulate the plugin’s configuration through exposed endpoints. This allows an attacker to modify email routing, sender details, or potentially inject arbitrary email content, leading to phishing or data disclosure. The weakness is categorized as CWE-862: Missing Authorization.

WordPress plugin Contact Form Email by codepeople, versions 1.3.63 or earlier, running on any WordPress site.

The flaw has a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1%, meaning it is unlikely to be heavily exploited. It is not listed in CISA’s KEV catalog. The vulnerability can be exploited by sending crafted HTTP requests to the plugin’s configuration endpoint, which is currently accessible without proper role validation. Because it is exposed via a web interface, an attacker with network access to the site can gain unauthorized configuration power, potentially enabling phishing or other malicious email usage.