This vulnerability in codepeople Contact Form Email (<= 1.3.58) arises from missing authorization checks, enabling attackers with low privileges to bypass access controls. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, required privileges at low level, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The issue stems from incorrectly configured access control security levels in the plugin's contact form handling.

An attacker with low privileges can exploit this vulnerability to access sensitive information through the contact form email functionality without proper authorization. This leads to a high confidentiality impact but does not affect data integrity or system availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity related to contact form submissions. Avoid exposing the vulnerable functionality to untrusted users where possible.