The vulnerability arises from the New User Approve WordPress plugin’s insecure validation of the Zapier REST API key. The plugin compares the supplied api_key parameter to a stored value using loose PHP equality, allowing a typed value such as "0" to bypass authentication when the Zapier key is unset. This flaw enables attackers to invoke endpoints that list usernames and email addresses of all users, regardless of their approval status, thereby leaking sensitive personal data.

WordPress sites running the New User Approve plugin version 3.0.9 or earlier are affected. The issue originates in the zapier REST API endpoint files located under includes/zapier/includes/rest-api.php. If a site has not configured a Zapier API key, it is particularly vulnerable.

The CVSS v3 score is 5.3, indicating moderate severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires only an unauthenticated request to the exposed REST endpoint with the api_key set to "0", which is straightforward for an attacker to perform over HTTP or HTTPS routes that expose the API.