CVE-2026-16149: CWE-269 Improper Privilege Management in marc4 Security Hardener

CVE-2026-16149 is an improper privilege management vulnerability (CWE-269) in the Security Hardener WordPress plugin (marc4 project) affecting all versions up to 2.4.4. The plugin's user-enumeration protection hooks into the rest_endpoints filter and replaces the permission_callback handlers for the /wp/v2/users and /wp/v2/users/(?P<id>[\d]+) REST API routes. This replacement uses a minimal check (is_user_logged_in()) that bypasses WordPress Core's original capability checks such as create_users, promote_user, edit_users, and delete_users enforced by WP_REST_Users_Controller. Consequently, authenticated attackers with low privileges can escalate their privileges by creating Administrator accounts or resetting Administrator passwords via POST or PUT requests to these endpoints. The vulnerability is present by default because the block_user_enum option is enabled by default, requiring no special configuration to exploit.

The vulnerability allows authenticated users with Subscriber-level access or above to escalate privileges to Administrator by creating new Administrator accounts or resetting existing Administrator passwords. This leads to full compromise of the WordPress site, including confidentiality, integrity, and availability impacts as reflected by the CVSS score of 8.8 (high severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the Security Hardener plugin or the user-enumeration protection feature if possible. Monitor for plugin updates from the vendor that address this authorization bypass vulnerability.