The FleekDash V2 WordPress plugin contains an authorization bypass flaw that allows any authenticated user with subscriber level or higher to overwrite the email address and password of any user, including administrators. Because the plugin does not verify that the acting user is permitted to perform these changes, an attacker can effectively take over an administrator account and gain complete control of the site. The vulnerability also includes an exposed REST endpoint that automatically creates a subscriber account and returns a valid nonce regardless of the site's registration setting, enabling unauthenticated users to acquire the necessary credentials and nonce in a single request.

All installations of FleekDash V2 for WordPress with versions up to and including 2.6.2.2 are affected. Sites running the plugin in any WordPress environment are at risk if they have not upgraded beyond the stated version.

The vulnerability scores a CVSS of 8.8, indicating high severity. An EPSS score of less than 1% suggests that exploitation is not yet widely observed, and the flaw is not listed in the CISA KEV catalog. However, the attack path is straightforward: an authenticated subscriber or an attacker who self‑provisions a subscriber account via the public /wp-json/fleekdash/v1/register endpoint can then use the vulnerable /wp-json/fleekdash/v1/users/{id} REST endpoint to change any user's credentials. The combination of a low exploitation probability with the high potential impact warrants prompt remediation.