A missing authorization check in the leadlovers forms plugin allows attackers to access or alter administrative settings and form data without proper permission. This broken access control can lead to data exposure, unauthorized modifications of form behavior, or the use of the site as a platform for further attacks. The weakness is classified as CWE‑862.

This issue affects installations of the leadlovers forms plugin for WordPress with version numbers up to and including 1.0.2. Any WordPress site that has this plugin enabled in that version range is vulnerable, regardless of how the site is accessed.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a web-based request that bypasses missing access controls; this is inferred from the description of a missing authorization check. No additional prerequisites are noted, so any authenticated user with access to the site could potentially exploit the flaw through crafted requests.