The vulnerability stems from the plugin's use of a predictable password for 25 default dummy accounts. The password is derived from the first 15 characters of a SHA-256 hash of the site's AUTH_KEY and URL, while the full 25‑character hash is sent to the client in a hidden form field that can be accessed without authentication. An attacker can harvest this value from a single request to the registration page or its AJAX handler, reconstruct the full password, and log in as any dummy user. If any dummy accounts have elevated roles, the attacker may gain higher privileges. This flaw does not allow arbitrary code execution, but does enable compromised account usage and potential privilege escalation.

All sites using the UsersWP plugin version 1.2.78 or earlier. The affected product is "UsersWP – Front‑end login form, User Registration, User Profile & Members Directory plugin for WP" developed by stiofansisland. Administrators who have enabled dummy user accounts via the plugin's Tools page are at risk.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is unavailable, implying the current exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog, but requires no special privileges to exploit. An unauthenticated attacker can exploit the flaw simply by querying the public registration form or its AJAX endpoint and then use the retrieved password to authenticate as any of the 25 dummy accounts through the standard WordPress login page. Successful exploitation can result in unauthorized access and potential privilege escalation if dummy accounts are granted administrative roles.