The vulnerability is a missing authorization flaw in the Saad Iqbal New User Approve plugin, allowing unauthorized users to approve new user registrations. This flaw is classified as CWE-862 and can lead to the creation or activation of accounts without proper verification, potentially compromising confidentiality and integrity of the site’s user database.

The issue affects the WordPress New User Approve plugin version 3.2.0 and all earlier releases. Users running the plugin on WordPress installations should check for updates and apply the latest version if available.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score is less than 1%, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is likely remote via the web interface of the WordPress admin area, where an attacker could craft a request to the approval endpoint and bypass authorization checks. Given that the flaw permits account creation or approval, an attacker could gain privileged access or perform phishing or credential theft.