This vulnerability involves missing authorization checks in the CRM Perks Integration plugin for Salesforce and popular WordPress form plugins (Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms). The flaw arises from improperly configured access control, allowing users with limited privileges to potentially perform unauthorized actions. The affected versions are up to 1.4.6. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges, no user interaction, and limited confidentiality impact. The service is cloud-hosted, and the vendor manages remediation server-side. A patch is available.

The vulnerability could allow an attacker with low privileges to bypass access controls, potentially leading to unauthorized access to certain data or functions within the CRM Perks Integration service. The confidentiality impact is low, with no integrity or availability impacts reported. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Since the affected product is a cloud-hosted service, the vendor manages remediation on their side. Users should verify with the vendor advisory that their environment has been updated accordingly. No additional action is required if the vendor confirms mitigation.