This vulnerability in ZealousWeb Abandoned Contact Form 7 (<= 2.2) is caused by missing authorization checks, which allows attackers to bypass access control mechanisms. The CVSS 3.1 score of 8.2 reflects network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity and availability but not confidentiality. The issue arises from incorrectly configured access control security levels, enabling unauthorized actions within the plugin.

The vulnerability can be exploited remotely without authentication or user interaction. While confidentiality is not affected, the integrity of data can be compromised and availability can be severely impacted, potentially disrupting the normal operation of the affected plugin or system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity related to Abandoned Contact Form 7. Avoid exposing the plugin to untrusted networks where possible.