This vulnerability, identified as CWE-862 (Missing Authorization), affects Ultra Addons for WPForms versions up to 1.0.11. It allows users with subscriber-level privileges to bypass intended access restrictions, leading to potential unauthorized modifications or disruptions. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and scope change with impact on integrity and availability but not confidentiality. No known exploits are reported, and no vendor-provided patch or remediation level is documented.

Exploitation of this vulnerability could allow a subscriber-level user to perform actions beyond their intended permissions, potentially altering data or causing service disruption. Confidentiality of data is not impacted. The scope change indicates that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber privileges where possible and monitor for unusual activity related to Ultra Addons for WPForms. Avoid granting unnecessary permissions to subscriber roles.