This vulnerability in codepeople Contact Form Email (<= 1.3.63) arises from missing authorization checks, enabling attackers with low privileges to exploit improperly configured access control. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates that an attacker can remotely exploit this flaw with low complexity and no user interaction, resulting in high confidentiality impact but no integrity or availability impact. No patch or official remediation details are provided in the available data.

An attacker with low privileges can exploit this vulnerability remotely to gain unauthorized access to sensitive information handled by the Contact Form Email plugin. The confidentiality of data is compromised, but there is no reported impact on data integrity or system availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations on the Contact Form Email plugin to prevent unauthorized access. Monitor for updates from the vendor regarding patches or official mitigations.