The vulnerability is a missing authorization flaw in the New User Approve plugin that allows attackers to bypass the plugin’s built‑in access control checks. Because the plugin mediates who can approve new WordPress users, the flaw enables an attacker to create or approve user accounts without the required permissions. The weakness is classified as CWE‑862, indicating improper authorization.

Affected systems include any deployment of the myCred New User Approve plugin with versions up to and including 3.2.8. The plugin is a WordPress component, so any site that installs or continues to use these versions is potentially vulnerable unless the plugin is upgraded to at least 3.2.9.

The CVSS score of 5.3 places this issue in the medium severity range. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The lack of explicit attack vector information in the advisory suggests the attack may originate from the web interface that exposes the plugin’s approval functionality; any user with access to that interface could potentially exploit the flaw. The vendor’s recommendation is to apply the patch by upgrading to the latest version, which removes the missing authorization checks.