A missing authorization vulnerability exists in the Campaign Monitor for WordPress plugin (forms-for-campaign-monitor) up to and including version 2.9.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized users with limited privileges to perform actions they should not be permitted to. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity level with low attack complexity and no user interaction required.