CVE-2025-30767 is a missing authorization vulnerability in the PDF for WPForms plugin by add-ons.org. This flaw arises from incorrectly configured access control security levels, potentially allowing attackers with low privileges to access or modify data without proper authorization. The vulnerability affects all versions up to 5.3.0. The CVSS 3.1 base score is 5.4, reflecting network-based exploitation with low complexity and no user interaction required. Confidentiality and integrity impacts are limited, with no effect on availability. No vendor advisory or patch information is currently provided.

The vulnerability could allow an attacker with low privileges to bypass access controls, leading to limited confidentiality and integrity impacts on the affected system. There is no indication of availability impact or widespread exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations for the PDF for WPForms plugin where possible. Monitor vendor channels for updates and apply patches promptly once available.