The UsersWP plugin for WordPress contains a missing authorization flaw that permits attackers to bypass intended access controls. By exploiting improperly configured security levels, an attacker can access features or data that should remain restricted. This vulnerability is recognized as a missing authorization issue (CWE-862). The potential impact includes unauthorized data exposure, alteration of user accounts, or modification of site content.

The affected product is the Stiofan UsersWP plug-in for WordPress, versions up to and including 1.2.74. Any installation relying on a vulnerable version, regardless of platform configuration, is susceptible.

The CVSS score of 6.5 categorizes this flaw as medium risk. The EPSS score is not available, so the likelihood of exploitation cannot be quantified from the current data, and this vulnerability is not listed in the CISA KEV catalog. Attackers would typically need the ability to reach the plug‑in’s management endpoints, inferred to be through a web‑based interface since the description does not explicitly state the entry points. Once the plug‑in’s incorrect access control is leveraged, the attacker can read or modify restricted content without proper authorization.