The FormLayer WordPress plugin, when used with a version older than 1.0.9, fails to perform an authorization check on its public form submission handler. As a result, any unauthenticated user can submit a form and receive a response that contains the entire stored configuration of that form, including notification recipient addresses, confirmation redirect URLs, and integration settings. This represents a direct information disclosure vulnerability (CWE‑200) and shows a lack of proper access control for a privileged operation.

The affected product is the WordPress plugin FormLayer; all releases prior to version 1.0.9 are impacted. No further vendor or subproduct detail is available from the CNA.

Because the endpoint is publicly reachable, an attacker can reliably extract confidential configuration data without needing credentials. The CVSS score is 5.3, indicating moderate risk. The EPSS score of 0.00145 indicates a very low but nonzero probability of exploitation, reflecting the difficulty or rarity of real-world attacks. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a simple HTTP POST to the form submission URL, so the vulnerability is both easy to exploit and does not require sophisticated skills.