This vulnerability in kamleshyadav WP Lead Capturing Pages (versions prior to 2.6) is caused by missing authorization checks, leading to incorrect access control configurations. The CVSS 3.1 score is 7.5 (high), with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. The lack of authorization could allow attackers to disrupt service availability. No patch or vendor advisory is currently provided.

The vulnerability allows attackers to bypass authorization controls, potentially causing denial of service or disruption of availability in the affected plugin. There is no impact on confidentiality or integrity. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to the lead capture functionality. Avoid exposing the plugin to untrusted networks if possible.