The PowerPack for LearnDash plugin before version 1.3.0 has an AJAX action that performs no authorization or CSRF validation, allowing any user to modify any WordPress option or create new administrator accounts. This violates the principle of least privilege and can grant an attacker full control of the site. The flaw is an authorization failure (CWE-862).

WordPress sites running the PowerPack for LearnDash plugin older than 1.3.0 are affected; no other vendors or products are listed.

The CVSS score of 9.8 classifies this as a critical vulnerability, while the EPSS score of less than 1% suggests low current exploitation probability. Nonetheless, the absence of authentication on the AJAX endpoint makes exploitation straightforward: a remote attacker can directly send a crafted request to update options or create admin users without possessing valid credentials. The vulnerability is not listed in the KEV catalog, indicating no reported public exploits as of the latest data.