The New User Approve WordPress plugin does not enforce authentication on certain REST API endpoints when a Zapier integration is left unconfigured. An attacker who can access the REST API can retrieve personally identifiable information such as a user’s ID, username, email address and registration date. The vulnerability is a classic information‑exposure flaw that allows an unauthenticated attacker to obtain private user data without any additional privileges.

WordPress installations running the New User Approve plugin versions earlier than 3.2.10 are affected. This includes all sites that have not upgraded to 3.2.10 or later, regardless of whether Zapier integration has been activated.

The vulnerability can be exploited remotely over the web interface by sending a crafted API request to the affected endpoints. Because authentication is not required, any internet‑connected attacker can trigger the disclosure. The vulnerability has a CVSS score of 5.3 and an EPSS score of <1%, and is not listed in the CISA KEV catalog, indicating a moderate potential exploitation likelihood. However, the potential impact of personal data exposure is significant, and the flaw is unprotected by any authentication or authorization controls.