This vulnerability (CWE-862) in the Loopus WP Cost Estimation & Payment Forms Builder plugin arises from missing authorization checks, allowing unauthenticated attackers to perform actions without proper permissions. It affects all versions up to 10.1.76. The CVSS 3.1 base score is 6.5, with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts limited to integrity and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported.

The missing authorization vulnerability could allow attackers to perform unauthorized actions that may alter data or disrupt service availability within the affected plugin. There is no indication of confidentiality impact. The overall impact is limited to integrity and availability, consistent with the CVSS vector and score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin's functionalities and monitor for unusual activity related to the plugin. Avoid exposing the plugin to untrusted users where possible.