CVE-2024-0372 is a missing authorization vulnerability in the Views for WPForms – Display & Edit WPForms Entries on your site frontend WordPress plugin by aman086. The issue arises from the lack of a capability check in the 'get_form_fields' function, allowing authenticated users with subscriber privileges or higher to create form views without proper authorization. This could lead to unauthorized access to form data views. The vulnerability affects all versions up to and including 3.2.2. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, privileges required at the level of a logged-in subscriber, no user interaction, unchanged scope, and limited confidentiality impact.

An authenticated attacker with subscriber-level access or higher can create form views on the frontend without proper authorization, potentially exposing form data that should be restricted. The impact is limited to confidentiality as per the CVSS vector, with no integrity or availability impact reported. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities if possible or monitor for suspicious activity related to form view creation. Avoid granting unnecessary permissions to low-privilege users. Follow updates from the plugin vendor or WordPress security channels for patch availability.