The UltimateAI plugin for WordPress contains an authentication bypass vulnerability (CWE-703) due to improper empty value checks and missing default activation checks in the 'ultimate_ai_change_pass' function. This flaw allows unauthenticated attackers to reset the password of the first user account that is either inactive or newly activated and has subscriber privileges. The vulnerability affects all versions up to and including 2.8.3. The CVSS 3.1 base score is 5.6, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. There is no vendor advisory or patch information provided, and no known exploits have been reported.

An unauthenticated attacker can reset the password of the first user account under specific conditions, potentially gaining access to that account. This could lead to limited unauthorized access depending on the privileges of the affected user. The impact is rated medium with low-level confidentiality, integrity, and availability impacts as per the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should monitor for updates from Tophive and consider restricting access to the affected plugin or disabling it if feasible. No vendor advisory or official patch information is currently provided.