The vulnerability identified as CVE-2025-32213 affects the Flo Forms plugin by flothemesplugins. It is caused by missing authorization checks due to incorrectly configured access control security levels. This allows users with some privileges (low privilege) to access or perform actions that should be restricted. The issue affects all versions up to 1.0.43. The CVSS v3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker with low privileges can exploit this vulnerability to gain unauthorized access to sensitive information, resulting in a high confidentiality impact. There is no impact on integrity or availability. No known exploits in the wild have been reported, and the vulnerability is rated medium severity based on the CVSS score of 6.5.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Flo Forms plugin to trusted users only and monitor for unusual access patterns related to this plugin. Avoid granting unnecessary privileges to users interacting with Flo Forms.