This vulnerability is a missing authorization flaw that allows an attacker to exploit incorrectly configured access control in the Mailercloud – Integrate webforms and synchronize website contacts plugin. The flaw enables unauthenticated users to read or manipulate contact records stored by the plugin, potentially leading to data exposure, data tampering, or the injection of malicious entries that could compromise the website’s integrity and user privacy.

The affected product is Mailercloud – Integrate webforms and synchronize website contacts, with all versions from the earliest release through version 1.0.7 susceptible to the issue. No other vendors or products are impacted.

The CVSS score of 5.3 indicates a medium severity level, while the EPSS score of less than 1% suggests that exploit attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog. Attacks are likely to be carried out by sending crafted HTTP requests to the plugin’s endpoints; the precise vector is not detailed in the official record but can be inferred from the description of a broken access control mechanism.