The FormLayer WordPress plugin, when used with a version older than 1.0.9, fails to perform an authorization check on its public form submission handler. As a result, any unauthenticated user can submit a form and receive a response that contains the entire stored configuration of that form, including notification recipient addresses, confirmation redirect URLs, and integration settings. This represents a direct information disclosure vulnerability (CWE‑200) and shows a lack of proper access control for a privileged operation (CWE‑284).

The affected product is the WordPress plugin FormLayer; all releases prior to version 1.0.9 are impacted. No further vendor or subproduct detail is available from the CNA.

Because the endpoint is publicly reachable, an attacker can reliably extract confidential configuration data without needing credentials. The missing EPSS value indicates no publicly available data on current exploitation rates, but the existence of the flaw provides a foothold for reconnaissance or targeted attacks. The flaw is not listed in the CISA KEV catalog. The attack vector is a simple HTTP POST to the form submission URL, so the vulnerability is both easy to exploit and does not require sophisticated skills.