Authorization Bypass in Security Hardener Plugin for WordPress

The Security Hardener plugin for WordPress (versions 2.4.4 and earlier) contains a critical Missing Authorization vulnerability, assigned CVE-2026-16149. The flaw stems from the plugin's user-enumeration protection feature, which hooks into the WordPress rest_endpoints filter. Specifically, the secure_user_endpoints() function incorrectly overwrites the permission callbacks for the /wp/v2/users and /wp/v2/users/(?P<id>[\d]+) REST API routes.

By replacing WordPress Core's granular capability checks - such as create_users, promote_user, edit_users, and delete_users - with a simplistic is_user_logged_in() check, the plugin inadvertently permits any authenticated user to perform administrative actions. Since this protection feature is enabled by default upon installation, no specific configuration is required for an attacker to exploit the flaw. Successful exploitation allows a standard Subscriber account to create new Administrator accounts or overwrite the credentials of existing administrative users via crafted REST API requests.

Impact

Successful exploitation results in full administrative takeover of the WordPress site. An attacker can create new administrator accounts, delete content, modify site configuration, or gain remote code execution capabilities through administrative features like plugin/theme management. The vulnerability affects any WordPress instance where the Security Hardener plugin is active, posing a significant risk to site integrity and data security.

Recommendation

• Update the Security Hardener plugin to the latest version immediately to patch CVE-2026-16149.
• Audit existing user accounts for suspicious additions or modifications, specifically looking for new users created with administrator roles.
• Review WordPress REST API access logs for anomalous POST, PUT, PATCH, or DELETE requests directed at the /wp-json/wp/v2/users endpoint originating from low-privileged accounts.
• If patching is not immediately feasible, disable the user-enumeration protection feature within the Security Hardener plugin settings.