The Flynax Bridge plugin for WordPress contains a missing capability check in the registerUser() function in versions up to and including 2.2.0. This flaw allows an attacker who is not logged in to create new user accounts with the author role. Because authors can publish and edit content, the attacker can compromise the integrity and confidentiality of site content and potentially serve as a foothold for further attacks.

WordPress sites that use the Flynax Bridge plugin, v1rustyle Flynax Bridge, with any version ≤2.2.0. The vulnerability is confined to the plugin’s user registration feature and does not affect other components of WordPress directly.

The CVSS score of 7.3 indicates a high severity impact. The EPSS score is reported as <1%, suggesting exploitation is unlikely at present, though the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be web‑based; an unauthenticated attacker can register a new author account through the plugin’s registration endpoint on any affected WordPress site. Once an author account is created, the attacker can publish, edit, or delete posts, thereby subverting the site’s functionality.