The vulnerability is an insecure direct object reference in the WordPress Toolset Forms plugin. It allows an unauth manipulate form data by providing arbitrary object identifiers. The weakness falls under CWE‑639, meaning the application fails to enforce correct access controls on objects. If exploited, the attacker could read sensitive form submissions or alter stored data, potentially compromising confidentiality and integrity.

The issue affects installations of the Site Building with Toolset plugin suite, specifically the Toolset Forms component. Versions up to and including 2.6.24 are vulnerable. WordPress sites that have not upgraded the Toolset Forms plugin beyond 2.6.24 remain at risk.

The CVSS score is 7.5, indicating a high probability of significant impact. EPSS information is not available, so the exploitation likelihood is uncertain, but IDOR vulnerabilities are commonly targeted. The vulnerability is not listed in CISA’s KEV catalog. An attacker can trigger the IDOR by sending crafted HTTP requests authentication, leveraging the lack of proper access checks. The absence of an authentication requirement means that any remote host can attempt such requests, making the attack surface large. Given these factors, the overall risk is substantial for unpatched sites.