The WP Verify API plugin lacks an authorization check on one of its REST endpoints. An unauthenticated attacker can inject arbitrary data into the plugin's database table and trigger the site to send templated verification emails to any e-mail address supplied by the attacker. This flaw permits data tampering and can be abused for phishing or spamming, compromising the confidentiality and integrity of the site’s communication channel.

Any WordPress installation running the WP Verify API plugin version 1.0.0 or earlier is affected, as the vulnerability resides in all releases up to that point. No specific vendor or product range beyond the plugin itself is listed.

The flaw is exploitable through unauthenticated HTTP requests to the vulnerable REST route and there is no rate limiting, so an attacker could repeatedly send emails or modify database content. With a CVSS score of 5.3, the vulnerability carries a moderate severity, but the lack of authentication and potential for widespread abuse still represent significant risk. The vulnerability is not currently listed in CISA’s KEV catalog, and an EPSS score of <1% indicates a low but nonzero probability of exploitation, so the attack probability remains uncertain but the straightforward attack vector indicates a concern for active sites.