CVE-2024-12027 is a missing authorization vulnerability (CWE-862) in the Message Filter for Contact Form 7 plugin by kofimokome. The updateFilter() and deleteFilter() functions lack capability checks, enabling authenticated users with subscriber-level privileges or above to modify or delete filters without proper authorization. This affects all versions up to and including 1.6.3. The CVSS 3.1 base score is 4.3 (medium), reflecting low impact on integrity and no impact on confidentiality or availability. No known exploits are reported in the wild, and no patch or official remediation has been published yet.

The vulnerability allows unauthorized modification of message filters by authenticated users with subscriber-level access or higher. This could lead to unauthorized changes in how messages are filtered in Contact Form 7, potentially affecting the integrity of the filtering rules. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for suspicious changes to message filters. Avoid granting unnecessary privileges to low-level authenticated users.