The vulnerability allows an unauthenticated user to exploit the password recovery functionality of the Disable Comments for Any Post Types plugin to trigger password reset emails for any account. Because the plugin’s authentication checks can be bypassed, attackers may obtain reset tokens or otherwise compromise account credentials, presenting a substantial risk of unauthorized access. The flaw falls under CWE‑288, reflecting improper authentication controls.

Any WordPress site that has installed the Themeisle Disable Comments for Any Post Types (Remove comments) plugin, version 1.3.0 or earlier, regardless of host platform.

The CVSS score of 7.1 indicates high severity with moderate attack complexity. EPSS data is not available and the vulnerability is not listed in KEV. The remote attack vector is inferred to involve HTTP requests to the password‑recovery endpoint, requiring no credentials to exploit. If the plugin is left at a vulnerable version, attackers can trigger password‑reset emails for arbitrary users and potentially compromise their accounts.