This vulnerability in yonifre Maspik – Spam blacklist (<= 2.2.7) arises from missing authorization checks in the contact-forms-anti-spam feature. This misconfiguration allows users with limited privileges to perform actions beyond their intended access level, potentially leading to integrity and availability issues. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but limited integrity and availability impact.

The vulnerability allows unauthorized modification or disruption of the spam blacklist functionality, which could degrade the effectiveness of spam filtering or cause denial of service conditions. There is no impact on confidentiality. No known exploits in the wild have been reported, limiting observed impact to theoretical risk at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations for the contact-forms-anti-spam component to ensure proper authorization enforcement. Monitor for vendor updates or patches addressing this issue.