The Flynax Bridge plugin for WordPress fails to validate a user’s identity before allowing changes to account details such as email addresses. Unauthenticated attackers can alter an arbitrary user’s email, including administrators, and then trigger a password reset process to gain access to that account. This flaw permits full control over any user profile, effectively enabling an attacker to compromise the administrative layer of the site. The core weakness follows CWE‑862: Missing Permissions Check.

The vulnerability affects the Flynax Bridge plugin for WordPress versions 2.2.0 and earlier. Vendor‑identified product is Flynax Bridge; any deployment of the plugin in these versions is impacted.

With a CVSS score of 9.8 the issue is classified as Critical, indicating a high impact if exploited. The EPSS score of less than 1% suggests that exploit scenarios are currently uncommon, but the flaw remains accessible without authentication, implying a straightforward attack path. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers could exploit this by sending crafted HTTP requests to the request.php endpoint that bypasses authentication checks. No special privileges or system access are required to initiate the attack, making it a low‑barrier threat for any attacker with network access to the site.