The vulnerability exposes hard‑coded credentials that can be exploited via the password‑recovery feature of the Addi – Cuotas que se adaptan a ti WordPress plugin (versions up through 2.0.4). By abusing this flaw, an attacker can authenticate without legitimate user credentials and gain administrative access. This privileged access allows modification of site settings, data compromise, and potential use of the site for further attacks. The weakness is identified as CWE‑798.

Addi – Cuotas que se adaptan a ti WordPress plugin, version 2.0.4 and earlier. The vulnerability affects all installations using these plugin versions on any WordPress site.

The CVSS score of 7.5 classifies the issue as high severity. EPSS indicates a very low probability of exploitation (<1%), and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can trigger the flaw via the publicly accessible password recovery endpoint, indicating a remote and unauthenticated attack vector. While the vulnerability does not directly allow arbitrary code execution, it gives attackers complete control through the administrative interface.