CVE-2026-4003 felixmartinez CVE debrief

Who should care

This vulnerability affects users of the Users manager – PN plugin for WordPress, particularly those with versions up to and including 1.1.15. Unauthenticated attackers can exploit this vulnerability to update arbitrary user metadata for any user account, including the userspn_secret_token field.

Technical summary

The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update. The vulnerability exists due to a flawed authorization logic check in the userspn_ajax_nopriv_server() function. An unauthenticated attacker can exploit this vulnerability to update arbitrary user metadata, including the userspn_secret_token field. This issue affects all versions up to and including 1.1.15 of the plugin. The vulnerability is caused by the userspn_ajax_nopriv_server() function not properly verifying authentication or authorization before updating user meta via update_user_meta(). Additionally, the nonce required for the AJAX endpoint 'userspn-nonce' is exposed to all visitors via wp_localize_script on the public wp_enqueue_scripts hook, which makes the nonce check ineffective.

Defensive priority

High

Recommended defensive actions

• Update the Users manager – PN plugin to a version beyond 1.1.15
• Restrict access to the AJAX endpoint 'userspn-nonce'
• Monitor user meta updates for suspicious activity
• Implement additional authentication and authorization checks for user meta updates
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by [email protected]. The CVE record was published on 2026-04-08T05:16:06.347Z and last modified on 2026-07-24T21:10:00.143Z. Evidence is limited to reporter claims and CVE details. Defenders should verify affected versions, review plugin code for update_user_meta() calls, and monitor user meta updates for suspicious activity. The nonce exposure via wp_localize_script on the public wp_enqueue_scripts hook should be verified.

Official resources