The Vedrixa Forms plugin for WordPress contains an authorization bypass that allows any authenticated user with subscriber-level access or higher to overwrite the structure of any form. By sending the wefb_save_form_structure AJAX request, an attacker can inject attacker-controlled data into the plugin’s FORMS database table, adding, removing, or altering fields. This flaw violates proper access control (CWE-862) and compromises the integrity of the form definitions.

WordPress sites using the Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder plugin, version 1.1.1 or earlier. The vulnerability exists in all releases up to and including 1.1.1; newer versions are not mentioned in the advisory.

The CVSS score of 4.3 indicates a moderate impact, with the primary risk being integrity loss through unauthorized form modification. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to be authenticated with at least subscriber-level privileges; the authorization check is missing, so the exploit can be performed by any logged‑in user who can load a page containing a form shortcode, as the ajax-nonce is injected into the public frontend via wp_localize_script() and can be retrieved freely. Based on the provided description, the most likely attack vector is local through the authenticated user context.