Contact Form by WD – responsive drag & drop contact form builder tool <= 1.7.18 - Authorization Bypass

The Contact Form by WD – responsive drag & drop contact form builder tool plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the form_maker_cfm function in versions up to, and including, 1.7.18. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit forms, including entering stored cross-site scripting, as output is not properly escaped.