{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/security-hardener/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-16149"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Security Hardener"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Security Hardener plugin for WordPress (versions 2.4.4 and earlier) contains a critical Missing Authorization vulnerability, assigned CVE-2026-16149. The flaw stems from the plugin's user-enumeration protection feature, which hooks into the WordPress \u003ccode\u003erest_endpoints\u003c/code\u003e filter. Specifically, the \u003ccode\u003esecure_user_endpoints()\u003c/code\u003e function incorrectly overwrites the permission callbacks for the \u003ccode\u003e/wp/v2/users\u003c/code\u003e and \u003ccode\u003e/wp/v2/users/(?P\u0026lt;id\u0026gt;[\\d]+)\u003c/code\u003e REST API routes.\u003c/p\u003e\n\u003cp\u003eBy replacing WordPress Core's granular capability checks - such as \u003ccode\u003ecreate_users\u003c/code\u003e, \u003ccode\u003epromote_user\u003c/code\u003e, \u003ccode\u003eedit_users\u003c/code\u003e, and \u003ccode\u003edelete_users\u003c/code\u003e - with a simplistic \u003ccode\u003eis_user_logged_in()\u003c/code\u003e check, the plugin inadvertently permits any authenticated user to perform administrative actions. Since this protection feature is enabled by default upon installation, no specific configuration is required for an attacker to exploit the flaw. Successful exploitation allows a standard Subscriber account to create new Administrator accounts or overwrite the credentials of existing administrative users via crafted REST API requests.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative takeover of the WordPress site. An attacker can create new administrator accounts, delete content, modify site configuration, or gain remote code execution capabilities through administrative features like plugin/theme management. The vulnerability affects any WordPress instance where the Security Hardener plugin is active, posing a significant risk to site integrity and data security.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Security Hardener plugin to the latest version immediately to patch CVE-2026-16149.\u003c/li\u003e\n\u003cli\u003eAudit existing user accounts for suspicious additions or modifications, specifically looking for new users created with administrator roles.\u003c/li\u003e\n\u003cli\u003eReview WordPress REST API access logs for anomalous POST, PUT, PATCH, or DELETE requests directed at the \u003ccode\u003e/wp-json/wp/v2/users\u003c/code\u003e endpoint originating from low-privileged accounts.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, disable the user-enumeration protection feature within the Security Hardener plugin settings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-23T01:34:06Z","date_published":"2026-08-23T01:34:06Z","id":"https://feed.craftedsignal.io/briefs/2026-08-security-hardener-vuln/","summary":"The Security Hardener plugin for WordPress contains an authorization bypass vulnerability in versions 2.4.4 and earlier that allows authenticated subscribers to escalate privileges to administrator.","title":"Authorization Bypass in Security Hardener Plugin for WordPress","url":"https://feed.craftedsignal.io/briefs/2026-08-security-hardener-vuln/"}],"language":"en","title":"CraftedSignal Threat Feed - Security Hardener","version":"https://jsonfeed.org/version/1.1"}