A critical missing authorization flaw in the DeluxeThemes Userpro plugin enables unauthenticated attackers to bypass access controls, posing a significant risk to site integrity.

This is a missing authorization vulnerability (CWE-862) occurring within the Userpro plugin, which permits unauthenticated remote attackers to perform unauthorized actions due to improper access control enforcement.

The exploitation of this vulnerability allows unauthorized actors to manipulate restricted functions or data without needing a valid user account. With a CVSS score of 8.8, this flaw represents a high risk to business operations, potentially leading to unauthorized data modification or administrative privilege escalation that could compromise the entire WordPress environment.

Immediate Action: Since no official patch version is confirmed, administrators should immediately disable or deactivate the Userpro plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server and WordPress access logs for anomalous request patterns targeting the plugin's endpoints, specifically looking for unauthorized POST or GET requests originating from unauthenticated sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access attempts to the known vulnerable plugin paths until a permanent fix is applied.

Public Exploit Available: Unknown.

Given the high CVSS score and the lack of required authentication for exploitation, this vulnerability poses a severe threat to any WordPress installation utilizing the Userpro plugin. Security teams should prioritize the immediate deactivation of the plugin to prevent potential unauthorized access while awaiting official remediation from DeluxeThemes.