CVE-2026-16149 is an improper privilege management vulnerability (CWE-269) in the Security Hardener plugin for WordPress. The plugin's user-enumeration protection feature hooks into the rest_endpoints filter and replaces permission callbacks for the /wp/v2/users and /wp/v2/users/<id> REST API routes with a function that only checks if the user is logged in. This replacement removes WordPress Core's original capability checks such as create_users, promote_user, edit_users, and delete_users. As a result, authenticated users with Subscriber-level privileges can exploit this flaw to create new Administrator accounts or reset existing Administrator passwords by sending crafted POST or PUT requests to the affected REST endpoints. The vulnerability affects all versions up to and including 2.4.4, and the insecure behavior is enabled by default via the block_user_enum option.

An attacker with only Subscriber-level access can escalate privileges to Administrator by creating new admin accounts or resetting admin passwords through the WordPress REST API. This leads to full site compromise, including complete control over the WordPress installation, content, and user management. The vulnerability has a high CVSS score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the Security Hardener plugin or the user-enumeration protection feature if possible. Restrict access to the REST API endpoints for users with low privileges as a temporary mitigation. Monitor vendor channels for an official patch or update addressing this vulnerability.