CVE-2026-16149 marc4 CVE debrief

Who should care

Defenders responsible for WordPress installations with the Security Hardener plugin should assess exposure and prioritize updating the plugin to a version beyond 2.4.4. This includes operators managing WordPress environments, platform administrators, vulnerability management teams, and security teams who need to verify the presence of this plugin, assess potential impact, and ensure timely updates to mitigate the risk of unauthorized account creation or  

Why it matters

The Security Hardener plugin for WordPress has a Missing Authorization vulnerability that allows authenticated attackers to create new Administrator accounts or reset existing Administrator passwords. Defenders should prioritize verifying the presence of this plugin in their WordPress installations and ensure that it is updated to a version beyond 2.4.4.

• Authenticated attackers with Subscriber-level access and above can create new Administrator accounts.
• Authenticated attackers with Subscriber-level access and above can reset an existing Administrator's password.
• Defenders need to verify the presence of this plugin in their WordPress installations and ensure that it is updated to a version beyond 2.4.4.
• The vulnerability allows for potential privilege escalation in WordPress installations.

Technical summary

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the rest_endpoints filter via secure_user_endpoints() and overwrites every registered handler's permission_callback on both the /wp/v2/users and /wp/v2/users/(?P<id>[<digit>]+) routes — including POST, PUT, PATCH, and DELETE handlers — with a bare closure that returns only is_user_logged_in(), completely stripping WordPress Core's original capability checks such as create_users, promote_user, edit_users, and delete_users that WP_REST_Users_Controller normally enforces.

Defensive priority

Defenders should prioritize verifying the presence of this plugin in their WordPress installations and ensure that it is updated to a version beyond 2.4.4 if possible.

Recommended defensive actions

• Verify the presence of the Security Hardener plugin in WordPress installations and update to a version beyond 2.4.4 if possible.
• Restrict access to the /wp/v2/users endpoint to prevent unauthorized account creation or password reset.
• Monitor for suspicious activity related to account creation or password reset attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists because the plugin's user-enumeration protection hooks the rest_endpoints filter and overwrites every registered handler's permission_callback on both the /wp/v2/users and /wp/v2/users/(?P<id>[<digit>]+) routes with a bare closure that returns only is_user_logged_in().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.