This vulnerability in E-goi Smart Marketing SMS and Newsletters Forms (up to version 5.0.4) involves missing authorization checks, which means that certain actions can be performed without proper access control validation. The CVSS score is 4.3 (medium severity), with an attack vector over the network, low attack complexity, requiring low privileges, no user interaction, and impacting integrity but not confidentiality or availability. The vulnerability arises from incorrectly configured access control security levels in the plugin's forms functionality.

An attacker with low privileges could exploit this missing authorization vulnerability to perform unauthorized actions that affect the integrity of the system or data managed by the Smart Marketing SMS and Newsletters Forms plugin. There is no impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is provided in the available data, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the plugin's administrative interfaces to trusted users only and review access control configurations to minimize exposure.