The vulnerability is a missing authorization flaw in the Kaliforms Kali Forms WordPress plugin that allows exploitation of improperly configured access control security levels. Without the proper access checks, functions reserved for privileged users can be performed by any user interacting with the plugin, leading to potential exposure of form submissions, unauthorized data manipulation, or other unintended administrative actions.

All installations of the Kaliforms Kali Forms plugin from the earliest version through 2.4.27 are affected. The plugin is used to manage form submissions on WordPress sites, and the flaw applies across that entire version range.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to the plugin’s endpoints and relies on the absence of authorization checks, meaning an attacker who can interact with those endpoints could perform unauthorized privileged actions.