This vulnerability in Themeisle's 'Disable Comments for Any Post Types (Remove comments)' plugin permits an attacker with limited privileges to bypass authentication mechanisms by leveraging an alternate path or channel. The flaw specifically allows exploitation of the password recovery process, potentially enabling unauthorized actions that affect the integrity and availability of the affected system. The issue affects versions up to 1.3.0. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. No official patch or vendor remediation level has been published yet.

The vulnerability allows an attacker to bypass authentication controls and exploit the password recovery functionality, which can lead to unauthorized modification or disruption of the affected system's operations. While confidentiality is not impacted, the integrity and availability of the system can be compromised. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity related to password recovery processes. Avoid exposing the plugin to untrusted networks where possible.