CVE-2026-16149: Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite
The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints() and overwrites every registered handler's permissioncallback on both the /wp/v2/users and /wp/v2/users/(?P<id>[\d]+) routes — including POST, PUT, PATCH, and DELETE handlers — with a bare closure that returns only isuserloggedin(), completely stripping WordPress Core's original capability checks such as createusers, promoteuser, editusers, and deleteusers that WPRESTUsersController normally enforces. This makes it possible for authenticated attackers with Subscriber-level access and above to create new Administrator accounts by sending POST request to /wp/v2/users with administrator role, or to reset an existing Administrator's password by issuing a PUT/POST request to /wp/v2/users/<id>. Because the blockuserenum option defaults to enabled, no special plugin configuration is required — the overwrite is active on every request as soon as the plugin is installed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Security Hardener (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.4.4 - Configuration
No additional plugin configuration is required because block_user_enum is enabled by default and overwrites every registered REST handler's permission_callback as soon as the plugin is installed.
Security Hardener plugin for WordPress block_user_enum = enabled-by-default (no special plugin configuration required) - Compensating control
Restrict access so that only trusted users can reach the WordPress REST API routes /wp/v2/users and /wp/v2/users/<id> (e.g., via firewall/ACL/WAF), since an authenticated Subscriber+ can create Administrator accounts or reset Administrator passwords through these endpoints.
Event History
Frequently Asked Questions
Are sites using the default plugin configuration affected?
Yes. The block_user_enum option is enabled by default, so the vulnerable permission-callback overwrite is active as soon as the plugin is installed.
What access does an attacker need to exploit this issue?
The attacker must be authenticated to WordPress. Subscriber-level access or any higher authenticated role is sufficient; no administrator capabilities are required.
What actions can a successful attacker take?
An authenticated low-privileged user can create an Administrator account through a POST request to /wp/v2/users. They can also reset an existing Administrator account's password using a PUT or POST request to /wp/v2/users/<id>.
How can I determine whether my site is exposed?
Check whether Security Hardener is installed at version 2.4.4 or earlier. Sites with the default block_user_enum setting enabled are exposed to the described REST API permission-check overwrite.
What configuration change can reduce exposure if remediation cannot be applied immediately?
The vulnerable behavior is tied to the plugin's user-enumeration protection controlled by block_user_enum. Disabling that protection removes the default condition under which the plugin overwrites the REST user-route permission callbacks.