The Custom Skins Contact Form 7 plugin for WordPress suffers from a missing capability check in the 'cf7cs_action_callback' function, which leads to unauthorized modification of data. Authenticated attackers with at least Subscriber-level privileges can exploit this flaw to update any post content and create new skins, actions normally restricted to higher privilege levels. This vulnerability is tracked as CVE-2024-12341 and is classified under CWE-862 (Missing Authorization). It affects all versions up to 1.0 of the plugin. The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

The vulnerability allows authenticated users with Subscriber-level access or higher to perform unauthorized modifications to post content and create new skins within the affected WordPress plugin. This could lead to content integrity issues but does not impact confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to post content changes and skin creation. Avoid granting Subscriber-level or higher access to untrusted users.