The Addi – Cuotas que se adaptan a ti plugin for WordPress contains hard‑coded credentials that can be exploited during the password‑recovery process. This weakness, identified as CWE‑798, allows an attacker to authenticate without valid user credentials, leading to full administrative access. Once authenticated, the attacker can modify site settings, compromise data, and potentially use the site as a platform for further attacks.

Addi – Cuotas que se adaptan a ti WordPress plugin, version 2.0.4 and earlier. The vulnerability affects all installations using these plugin versions on any WordPress site.

The CVSS score of 7.5 classifies the issue as high severity. EPSS indicates a very low probability of exploitation (<1%), and the vulnerability is not currently listed in the CISA KEV catalog. Attackers can trigger the flaw via the publicly accessible password recovery endpoint, meaning the vector is remote and unauthenticated. While the vulnerability does not directly allow arbitrary code execution, it gives attackers complete control through the administrative interface.