This vulnerability involves missing authorization checks in the CRM Perks Integration plugin for Mailchimp and several WordPress form plugins (Contact Form 7, WPForms, Elementor, Ninja Forms). It affects versions up to 1.2.2 and allows an attacker with some level of privileges (low privileges required) to access functionality or data without proper authorization. The CVSS vector indicates network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An attacker with low privileges can exploit this vulnerability to gain unauthorized access to sensitive information, impacting confidentiality. There is no impact on integrity or availability. No known exploits are reported in the wild, and the vulnerability affects the confidentiality of data handled by the plugin integration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin features to trusted users only and monitor for unusual access patterns. Avoid exposing the affected plugin interfaces to untrusted users.