The GP Unique ID plugin for WordPress suffers from improper input validation (CWE-20) allowing unauthenticated attackers to tamper with the unique ID generated on form submissions. This vulnerability affects all versions up to and including 1.5.5. Attackers can replace the generated unique ID with a user-controlled value, undermining the integrity of processes relying on the uniqueness of this ID. The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

The vulnerability allows unauthenticated attackers to modify unique IDs generated by the plugin, potentially causing loss of integrity in systems relying on these IDs for security. This could affect workflows or security controls that assume these IDs are unique and untampered. There is no confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting form submissions to trusted users if possible. Monitor vendor channels for updates and apply patches promptly once available.