The Claspo Popup Builder plugin contains a missing authorization vulnerability that permits unauthenticated access to restricted functions, posing a risk of unauthorized configuration changes.

This vulnerability is categorized as a missing authorization flaw (CWE-862) within the plugin. An unauthenticated attacker can trigger this issue over a network without requiring user interaction, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N.

Successful exploitation of this flaw allows attackers to bypass intended access controls within the plugin. While the impact is currently limited to partial integrity, unauthorized modification of form settings or lead generation configurations can lead to data manipulation, potential phishing risks for end users, and degradation of business process reliability. The CVSS score of 7.5 reflects the high accessibility of this flaw to remote, unauthenticated actors.

Immediate Action: Administrators should check the WordPress plugin repository for the latest version of the Claspo plugin and update immediately if a version exceeding 1.0.7 is available. If no patch is provided, deactivate the plugin until a secure version is released.

Proactive Monitoring: Review web server and WordPress access logs for unusual requests directed at plugin-specific endpoints or unauthorized changes to form configuration settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests to the plugin's administrative or AJAX endpoints, which can provide a layer of protection against unauthorized access attempts.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitability and the potential for unauthorized configuration changes, organizations utilizing the Claspo plugin must prioritize this update. We recommend auditing current plugin configurations and ensuring that administrative access is restricted to authorized personnel only, while monitoring for any unauthorized modifications to form behaviors.