The vulnerability is a missing authorization check in the WordPress WP User Manager plugin that allows attackers to leverage incorrectly configured access control. Users can potentially perform actions that should be restricted, such as modifying or creating user data, thereby compromising the integrity of user information.

The flaw is present in the WP User Manager WordPress plugin for any installation running a version up to and including 2.9.23. Sites that have not yet upgraded beyond 2.9.23 are therefore vulnerable. No specific WordPress core version is identified, so all sites using the affected build are at risk.

The CVSS score of 5.3 indicates a moderate risk level. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting low exploitation likelihood as of now. The likely attack vector is via HTTP requests to plugin endpoints that lack proper access checks; an attacker may need a valid user credential to interact, but the missing authorization removes the intended barrier.