The EleForms plugin for WordPress suffers from a missing authorization check (CWE-862) when handling requests to download form submissions. This security gap allows unauthenticated users to access form submission data, potentially exposing sensitive information. The vulnerability affects all versions up to and including 2.9.9.7. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality only.

An attacker without authentication can access form submission data, leading to unauthorized disclosure of potentially sensitive user information collected via forms. There is no impact on data integrity or availability reported. The exposure of form data could lead to privacy violations or information leakage depending on the nature of the submitted data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to form submission download functionality by limiting permissions or disabling the feature if possible. Monitor official channels for updates or patches from the plugin vendor.