The WS Form LITE WordPress plugin suffers from a missing capability check in its 'get_config' function, which leads to unauthorized read access to the plugin's configuration data. This vulnerability affects all versions up to and including 1.10.35. Because the authorization check is absent, unauthenticated attackers can retrieve sensitive settings including API keys. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with no privileges or user interaction required, and a confidentiality impact limited to partial data disclosure. No integrity or availability impacts are noted. No patch or vendor advisory is currently available to confirm remediation status.

An attacker without authentication can read sensitive configuration data from the plugin, including API keys for integrated services. This could potentially lead to further compromise depending on how those keys are used. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's endpoints or disabling the plugin if sensitive API keys are stored and exposure risk is unacceptable.