The Flynax Bridge plugin for WordPress lacks a required capability check on its deleteUser() function. This flaw allows an attacker who does not need to be logged in to call the function and remove any user account from the site. Deleting accounts can lead to loss of privileged access, disabling of legitimate users, and potential data loss or denial of services.

WordPress installations that have the Flynax Bridge plugin enabled and running a version up through 2.2.0 are affected. The vulnerability exists in every release up to that point.

The vulnerability carries a CVSS score of 5.3, indicating medium risk. An EPSS score of less than 1% shows a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, because the flaw permits unauthenticated deletion of any account, an attacker could craft an HTTP request to the plugin’s API endpoint and trigger deleteUser without needing credentials.