The Users manager – PN plugin for WordPress contains a privilege escalation vulnerability caused by improper authorization logic in the userspn_ajax_nopriv_server() function. Specifically, the function only blocks unauthenticated users when the user_id parameter is empty. If a non-empty user_id is supplied, the check is bypassed, allowing unauthenticated attackers to call update_user_meta() and modify arbitrary user metadata without any authentication or authorization. Additionally, the AJAX endpoint's nonce ('userspn-nonce') is exposed publicly via wp_localize_script on the public wp_enqueue_scripts hook, making the nonce check ineffective as a security control. This vulnerability affects all versions up to and including 1.1.15 and can be exploited remotely without user interaction.

Successful exploitation allows unauthenticated attackers to escalate privileges by modifying arbitrary user metadata, including sensitive fields such as userspn_secret_token. This can lead to full account compromise, data integrity loss, and potentially complete site takeover. The CVSS 3.1 score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the Users manager – PN plugin to prevent exploitation. Monitor official sources for updates or patches addressing this vulnerability. Do not rely on the nonce for protection as it is publicly exposed and ineffective in this context.