The vulnerability is a missing authorization check in the WP User Manager WordPress plugin that allows exploitation of incorrectly configured access control security levels. This is a CWE‑862 Broken Access Control flaw. It permits an attacker to perform actions that should be restricted by the plugin’s intended security controls.

WP User Manager plugin for WordPress installations running any version up to and including 2.9.24 are affected. All WordPress sites that have not upgraded beyond 2.9.24 are at risk.

The CVSS score of 5.3 indicates a moderate risk level, while the EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via HTTP requests to plugin endpoints that lack proper access verification, potentially enabling unauthorized actions without additional prerequisites explicitly stated in the CVE entry.