This vulnerability, identified as CWE-862 (Missing Authorization), affects MetForm Pro versions up to and including 3.9.1. It allows users with subscriber-level privileges to bypass access controls, potentially enabling unauthorized modifications or actions within the plugin. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and no user interaction required, but limited impact to integrity only. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

The vulnerability could allow a subscriber-level user to perform unauthorized actions that impact the integrity of the system or data managed by MetForm Pro. There is no confidentiality or availability impact reported. The scope remains unchanged, meaning the vulnerability affects only the MetForm Pro component without extending to other components or systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for unusual activity related to MetForm Pro. Avoid granting subscriber roles unnecessary permissions that could be exploited.