The Simple User Capabilities plugin for WordPress fails to perform a capability check on its 'wp_ajax_nopriv_reset_capability' AJAX endpoint. As a result, anyone who can reach the endpoint—even without logging in—can trigger a reset of another user’s capabilities. This represents an authorization bypass (CWE-862) that could allow an attacker to grant themselves admin-level access, remove privileges from administrators, or otherwise manipulate role configurations. The direct consequence is the loss of integrity over user roles and the potential for elevated privilege actions across the site.

The vulnerability affects all versions of the Simple User Capabilities plugin up to and including 1.0, as distributed by tanvirahmed1984 on the WordPress plugin repository. Any WordPress installation that has this plugin installed at a version 1.0 or earlier is susceptible. No specific sub-version information is provided, so the entire version range is considered at risk.

The CVSS score of 5.3 indicates a moderate security risk, while the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an unauthenticated HTTP request to the Ajax endpoint, meaning any unauthenticated user who can send a crafted request to the site’s AJAX handler can reset capabilities. No special privileges or credentials are required, making the attack vector broad for exposed WordPress sites that use this plugin.