marc4 CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH marc4 CVE published 2026-08-23

CVE-2026-16149

The Security Hardener plugin for WordPress has a Missing Authorization vulnerability in all versions up to, and including, 2.4.4. This vulnerability allows authenticated attackers with Subscriber-level access and above to create new Administrator accounts or reset an existing Administrator's password due to the plugin's flawed user-enumeration protection.