Wagtail CMS versions before 7.0.7, 7.3.2, and 7.4 contain an improper permission handling flaw that allows a CMS user with limited access to form pages to delete submissions for pages they do not control. By crafting a delete request on a page they can access, the attacker can bypass authorization checks and erase or modify data that should be protected, compromising the integrity and availability of form data.

The vulnerability affects all installations of Wagtail running versions earlier than 7.0.7, 7.3.2, or any 7.4.x version that has not applied the patch. Sites using these releases are susceptible until they upgrade to the fixed versions.

The CVSS score of 6.5 indicates moderate severity; EPSS data is unavailable and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated account with limited permissions, so an ordinary site visitor cannot exploit it. A threat actor would need to obtain or impersonate such a user, making the overall risk moderate but requiring timely remediation.