CVE-2024-0371 is an improper access control vulnerability in the Views for WPForms plugin for WordPress. The issue arises from the absence of a capability check in the 'create_view' function, enabling authenticated users with subscriber or higher privileges to create form views without proper authorization. This vulnerability affects all versions up to 3.2.2 and can lead to unauthorized modification of form view data. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and no user interaction required. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows authenticated users with subscriber-level access or higher to create form views on the site frontend without proper authorization. This could lead to unauthorized modification of form-related data but does not affect confidentiality or availability. There are no known exploits in the wild, and the impact is limited to integrity of form views within the plugin's functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider restricting subscriber-level access or higher from untrusted users and monitor plugin updates closely. No official patch or workaround information is currently available.