The UsersWP WordPress plugin exhibits a missing authorization flaw that permits users to exploit incorrectly configured access control levels. This vulnerability, identified as CWE‑862, allows individuals who would normally be barred from certain plugin features to gain unauthorized access and perform actions reserved for privileged users. The defect could compromise the confidentiality, integrity, and availability of content managed through the plugin, with a CVSS score of 5.3 indicating moderate severity.

The issue affects the Stiofan UsersWP plugin for WordPress, specifically all releases from any version through 1.2.47. WordPress sites that have the plugin installed at 1.2.47 or earlier are vulnerable, regardless of the hosting environment or other installed plugins.

The EPSS score for this vulnerability is listed as less than 1%, suggesting a low probability of exploitation at present. It is not included in the CISA KEV catalog. Attackers could potentially leverage the broken access controls by sending crafted HTTP requests to the plugin’s administrative endpoints; the vulnerability appears to be exploitable without needing administrative credentials, but the description does not explicitly confirm this, so the exact attack surface is somewhat inferred. Overall, the risk remains moderate, but the potential for unauthorized data exposure or tampering exists if the plugin is not updated.