This vulnerability in ListingPro Lead Form arises from missing authorization checks, allowing unauthenticated users to access functionality that should be protected by ACLs. The affected versions are up to and including 1.0.7. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but low impact on integrity. There is no vendor advisory or patch information provided, and the product is not a cloud service.

The vulnerability allows unauthorized access to certain functionality within the ListingPro Lead Form, potentially enabling unauthorized modification of data (integrity impact). There is no impact on confidentiality or availability. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality through other means such as web application firewalls or manual access controls where possible.