The themekraft WordPress plugin 'Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)' suffers from a missing capability check (CWE-862) in the buddyforms_new_page function in all versions up to 2.8.7. This flaw permits authenticated users with subscriber privileges or higher to create new pages with arbitrary titles that are published immediately, bypassing intended authorization controls. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium impact primarily due to unauthorized content creation without elevated privileges.

An attacker with subscriber-level access or higher can exploit this vulnerability to create arbitrary published pages on the affected WordPress site. This unauthorized content creation could be used to manipulate site content or inject misleading information. There is no direct impact on confidentiality or availability reported, and no known exploits in the wild have been documented at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix link is provided, site administrators should monitor the vendor's announcements for updates. In the meantime, restrict subscriber-level user registrations if possible and review user permissions to limit exposure.