Easy2Pilot 7 implements a cross‑site request forgery flaw that allows an attacker to create new administrative accounts. The vulnerability is triggered by a malicious page that submits a POST request to the admin.php?action=add_user endpoint with a username and password payload. An authenticated administrator who is tricked into visiting that page will inadvertently create a privileged user account, potentially granting the attacker full control over the system.

All installations of Easy2Pilot 7 are affected. The vulnerability is present in the Easy2Pilot product; no specific version numbers are provided beyond the major release 7. Administrators using this version should verify their local configuration and consider upgrades or mitigations.

The CVSS score of 5.1 indicates a moderate severity rating, and the EPSS score is not available. The vulnerability is listed as not in CISA KEV, suggesting it is not known to be exploited in the wild yet. The attack vector requires social engineering of an authenticated administrator; exploitation is possible through crafted forms or links delivered via email or another channel. Despite the moderate score, the impact of enabling unauthorized admin access warrants prompt action.