The GravityView plugin, when at or below version 3.0.0, contains unauthenticated insecure direct object references that allow an attacker to obtain submission data they should not be able to access. This weakness corresponds to CWE‑639 and can lead to confidentiality violations by exposing user‑submitted information. Attackers do not need any authentication to exploit this flaw, giving it a moderate level of severity but a realistic possibility of exploitation in environments where the plugin is exposed to the internet.

Any WordPress installation hosting the GravityKit:GravityView plugin version 3.0.0 or earlier is affected. The flaw applies to all instances of the plugin regardless of site configuration, as long as the vulnerable version remains installed.

The CVSS score of 5.3 indicates a moderate impact scenario. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires an attacker to request a GravityView URL that references a record ID; the absence of access checks allows arbitrary retrieval of submission data. Because authentication is not required, any visitor to the site can potentially exploit the vulnerability, and the attack vector is likely via simple crafted URLs or automated scanning tools.