The Users manager – PN WordPress plugin allows an attacker who is not logged in to call the AJAX endpoint 'userspn_form_save' and supply a non‑empty user_id. Because the plugin’s authorization logic only blocks requests when user_id is empty, it bypasses the check and updates arbitrary user meta via update_user_meta() even for locked user accounts. The required nonce is publicly exposed, rendering it useless. Attacker can change any meta field, including userspn_secret_token, effectively assuming control of an arbitrary user account.

This flaw affects all installations of the Users manager – PN plugin by felixmartinez with version 1.1.15 or earlier on any WordPress site that has the plugin activated.

With a CVSS score of 9.8, this vulnerability is considered critical. The lack of authentication or authorization checks means the attacker can exploit it from any web‑connected device simply by sending a crafted HTTP request to the exposed AJAX endpoint, provided they have the public nonce. The EPSS score is not published, and the issue is not listed in CISA’s KEV catalog, but the ease of exploitation and lack of mitigation make it a high‑risk asset. Adversaries likely would use automated scripts or malicious JS to submit the request and obtain a new token for the target account.