The Flynax Bridge WordPress plugin contains a missing authorization vulnerability (CWE-862) in its deleteUser() function. This flaw allows unauthenticated remote attackers to delete arbitrary user accounts due to the absence of capability checks. The vulnerability affects all versions up to 2.2.0 and has a CVSS 3.1 base score of 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity loss without affecting confidentiality or availability.

An attacker can delete arbitrary user accounts without authentication, leading to unauthorized loss of user data and potential disruption of user management. There is no impact on confidentiality or availability according to the CVSS vector. This could affect site administration and user access control but does not allow data disclosure or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's functionality and monitor for suspicious activity related to user deletions. Avoid exposing the plugin's endpoints to untrusted networks. Follow vendor updates closely for an official fix.