This vulnerability is an unauthenticated broken access control issue in Contact Form by WPForms versions up to 1.10.0.4. It allows attackers without any privileges to bypass authorization controls, impacting the integrity of the application. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no vendor advisory or patch information available at this time.

The vulnerability allows unauthenticated attackers to bypass access controls, potentially modifying or injecting unauthorized data or actions within the Contact Form by WPForms plugin. This impacts the integrity of the system but does not affect confidentiality or availability according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.