CVE-2026-4003 felixmartinez CVE debrief

Who should care

This vulnerability affects users of the Users manager – PN plugin for WordPress, particularly those with versions up to and including 1.1.15. Unauthenticated attackers can exploit this vulnerability to update arbitrary user metadata for any user account, including the userspn_secret_token field.

Technical summary

The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update. The vulnerability exists due to a flawed authorization logic check in the userspn_ajax_nopriv_server() function. An unauthenticated attacker can exploit this vulnerability to update arbitrary user metadata, including the userspn_secret_token field. This issue affects all versions up to and including 1.1.15 of the plugin. The vulnerability is caused by the userspn_ajax_nopriv_server() function not properly verifying authentication or authorization before updating user meta via update_user_meta(). Additionally, the nonce required for the AJAX endpoint 'userspn-nonce' is exposed to all visitors via wp_localize_script on the public wp_enqueue_scripts hook, which makes the nonce check ineffective.

Defensive priority

High

Recommended defensive actions

• Update the Users manager – PN plugin to a version beyond 1.1.15
• Restrict access to the AJAX endpoint 'userspn-nonce'
• Monitor user meta updates for suspicious activity
• Implement additional authentication and authorization checks for user meta updates
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by [email protected]. The CVE record was published on 2026-04-08T05:16:06.347Z and last modified on 2026-07-24T21:10:00.143Z. Evidence is limited to reporter claims and CVE details. Defenders should verify affected versions, review plugin code for update_user_meta() calls, and monitor user meta updates for suspicious activity. The nonce exposure via wp_localize_script on the public wp_enqueue_scripts hook should be verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.