The Forms Rb plugin fails to verify that a user is authorized to execute actions that involve the form_id parameter. This bug allows any authenticated user with at least Contributor level to view all form submission records, alter form configuration settings, and delete records belonging to forms that the user does not own. The impact is a loss of confidentiality, integrity, and partial control over the content of the site, without affecting system availability.

All installations of the Forms Rb WordPress plugin up to version 1.1.9 are vulnerable. The affected product is the Forms Rb plugin from rbplugins, which is installed within a WordPress site.

The CVSS v3.1 score of 4.3 indicates a moderate severity. No EPSS score is available, so the exploitation probability cannot be quantified, but the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is via the web application; an attacker only needs an authenticated Contributor+ user account, which narrows the target to sites that grant such roles but have not applied an update.