The New User Approve plugin for WordPress allows an attacker without any credentials to modify user account status and obtain sensitive information. The vulnerability is caused by missing authorization checks on multiple REST API endpoints in all releases up to and including 3.2.2. An unauthenticated user can send requests to approve or deny user accounts, retrieve user emails and roles, and trigger forced logouts of privileged users. This enables the attacker to alter platform integrity, leak confidential user data, and disrupt user availability.

The affected product is the WordPress plugin New User Approve developed by saadiqbal. All plugin versions up to 3.2.2 are vulnerable. Sites that install or update to any of these versions are at risk unless mitigated.

The CVSS base score is 7.3, indicating a high severity vulnerability, while the EPSS probability is less than 1%, suggesting a low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Because the vulnerable endpoints are reachable over the network via standard WordPress REST API calls, an attacker can trigger the exploit from any location that can reach the site, with no authentication or special privileges required. The overall exposure is moderate due to the low exploitation probability but remains significant because of the potential for unauthorized account manipulation and data disclosure.