CVE-2026-16149

Name of the Vulnerable Software and Affected Versions Security Hardener versions prior to 2.4.5

Description The Security Hardener plugin for WordPress contains a missing authorization flaw. The issue occurs because the user-enumeration protection, enabled by default, uses the secure user endpoints() function to hook the rest endpoints filter. This process overwrites the permission callback for all handlers on the '/wp/v2/users' and '/wp/v2/users/{id}' endpoints—including POST, PUT, PATCH, and DELETE methods—with a closure that only checks if a user is logged in via is user logged in(). Consequently, original WordPress Core capability checks such as create users, promote user, edit users, and delete users are removed. This allows authenticated users with Subscriber-level access or higher to create new Administrator accounts via POST requests to '/wp/v2/users' or reset Administrator passwords via PUT/POST requests to '/wp/v2/users/{id}'.

Recommendations Update the Security Hardener plugin to a version newer than 2.4.4. As a temporary mitigation, disable the block user enum option to prevent the overwrite of the permission callbacks.