The Kali Forms Contact Form & Drag-and-Drop Builder plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in its REST API endpoints. Authenticated users with contributor-level access or higher can bypass intended restrictions due to inconsistent capability checks, enabling them to view or modify forms and entries. This affects all versions up to 2.3.41. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, and limited confidentiality impact without integrity or availability impact. No official patch or remediation guidance is currently available from the vendor.

Authenticated users with contributor or higher privileges can access or modify form data via the REST API, potentially leading to unauthorized data exposure or modification within the plugin's scope. There is no indication of broader system compromise or denial of service. The impact is limited to the plugin's form data confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting REST API access for the Kali Forms plugin if possible. Monitor for vendor updates to apply an official patch once available.