The vulnerability is a missing authorization flaw in the vanquish User Extra Fields WordPress plugin. It permits an attacker to access or modify user data and plugin settings that should be restricted, exploiting an incorrectly configured access control security level. The identified weakness corresponds to CWE‑862. Abuse of this flaw could compromise the confidentiality and integrity of user information stored by the plugin.

The affected product is the vanquish User Extra Fields plugin (wp-user-extra-fields) for WordPress. All installations up to and including version 16.8 are vulnerable; there is no valid release after 16.8 that fixes the issue in the current data.

The CVSS base score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% shows a low likelihood of active exploitation. The vulnerability is not listed in CISA KEV, further suggesting limited widespread exploitation. Attackers would likely need to target a WordPress site with the vulnerable plugin installed; the flaw is a logical bypass of authorization checks, meaning that if an attacker can reach the plugin’s functionality—typically via authenticated access—they could exploit it. The overall risk remains moderate with a low current exploitation probability.