Block User Account
Monthly
Block User Account WordPress plugin before 2.0.1 fails to enforce account suspension across every authentication path, leaving blocked users able to retain their full role-level read and write access through the WordPress REST API when they hold an application password created prior to being blocked. All sites running the plugin at versions below 2.0.1 are affected. A publicly available exploit exists per WPScan reporting, though no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% (7th percentile) reflects limited observed real-world exploitation pressure.
Block User Account WordPress plugin before 2.0.1 fails to enforce account suspension across every authentication path, leaving blocked users able to retain their full role-level read and write access through the WordPress REST API when they hold an application password created prior to being blocked. All sites running the plugin at versions below 2.0.1 are affected. A publicly available exploit exists per WPScan reporting, though no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% (7th percentile) reflects limited observed real-world exploitation pressure.