CVE-2026-16149
Received Received - Intake

Security Hardener Plugin Missing Authorization Vulnerability

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: Wordfence

Description
The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the rest_endpoints filter via secure_user_endpoints() and overwrites every registered handler's permission_callback on both the /wp/v2/users and /wp/v2/users/(?P<id>[\d]+) routes — including POST, PUT, PATCH, and DELETE handlers — with a bare closure that returns only is_user_logged_in(), completely stripping WordPress Core's original capability checks such as create_users, promote_user, edit_users, and delete_users that WP_REST_Users_Controller normally enforces. This makes it possible for authenticated attackers with Subscriber-level access and above to create new Administrator accounts by sending POST request to /wp/v2/users with administrator role, or to reset an existing Administrator's password by issuing a PUT/POST request to /wp/v2/users/<id>. Because the block_user_enum option defaults to enabled, no special plugin configuration is required — the overwrite is active on every request as soon as the plugin is installed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-16149
EUVD
EUVD-2026-64605

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordfence security_hardener to 2.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Security Hardener plugin for WordPress has a vulnerability due to missing authorization checks. In versions up to 2.4.4, the plugin's user-enumeration protection modifies WordPress REST API routes for user management by replacing capability checks with a simple login check. This allows authenticated users with Subscriber-level access or higher to create new Administrator accounts or reset existing Administrator passwords.

Detection Guidance

Check WordPress REST API endpoints for unauthorized user creation or modification. Use curl to test /wp/v2/users endpoints with different HTTP methods (POST, PUT, PATCH, DELETE) and verify if Subscriber-level users can create or modify Administrator accounts. Example: curl -X POST -H 'Authorization: Bearer [token]' -d '{"username":"test","role":"administrator"}' http://yoursite.com/wp-json/wp/v2/users

Impact Analysis

This vulnerability allows attackers with basic user access to escalate privileges to Administrator level. They can create new admin accounts or reset existing admin passwords, gaining full control over the WordPress site. This could lead to complete site compromise, data theft, or further attacks.

Compliance Impact

This vulnerability allows authenticated attackers with Subscriber-level access to create Administrator accounts or reset Administrator passwords, potentially granting full control over a WordPress site. For GDPR, this could lead to unauthorized access to personal data, violating integrity and confidentiality principles. For HIPAA, unauthorized access to user data could compromise protected health information, leading to compliance breaches.

Mitigation Strategies

Update the Security Hardener plugin to the latest version if available. If not, disable the plugin immediately. Review user roles and remove unnecessary Administrator accounts. Monitor /wp/v2/users endpoints for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16149. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart