CVE-2026-16149: WordPress Security Hardener Auth Bypass

CVE-2026-16149 Overview

CVE-2026-16149 is a Missing Authorization vulnerability in the Security Hardener plugin for WordPress affecting all versions up to and including 2.4.4. The plugin's default user-enumeration protection overwrites permission callbacks on the WordPress REST API user routes, stripping WordPress Core's original capability checks. Authenticated users with Subscriber-level access can create Administrator accounts or reset existing Administrator passwords through the /wp/v2/users endpoint. The flaw is categorized under CWE-269: Improper Privilege Management.

Critical Impact
Any Subscriber-level user can escalate to Administrator by issuing a single POST request to /wp/v2/users, resulting in full site takeover.

Affected Products

Security Hardener plugin for WordPress, all versions through 2.4.4
WordPress sites with the plugin installed and default configuration
WordPress installations where block_user_enum option is enabled (default)

Discovery Timeline

2026-08-23 - CVE-2026-16149 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-16149

Vulnerability Analysis

The Security Hardener plugin implements user-enumeration protection through the secure_user_endpoints() function, which hooks into the rest_endpoints filter. This function overwrites the permission_callback on every registered handler for the /wp/v2/users and /wp/v2/users/(?P<id>[\d]+) routes. The replacement callback is a bare closure that returns only is_user_logged_in().

This overwrite applies to all HTTP methods, including POST, PUT, PATCH, and DELETE handlers. As a result, WordPress Core's WP_REST_Users_Controller capability checks are completely bypassed. Any authenticated user, regardless of role, passes the permission check on privileged user-management endpoints.

Root Cause

The root cause is unsafe overwriting of REST API permission callbacks without preserving the original capability logic. WordPress Core normally enforces create_users, promote_user, edit_users, and delete_users capabilities on the users controller. The plugin's closure discards these checks and substitutes a login-only gate.

The block_user_enum option defaults to enabled, so the vulnerable overwrite is active on every request as soon as the plugin is installed. No misconfiguration is required to trigger exploitable behavior.

Attack Vector

An attacker with Subscriber-level credentials authenticates to the target site and issues a POST request to /wp/v2/users with roles set to administrator and attacker-controlled username, email, and password fields. The endpoint accepts the request and provisions a new Administrator account. Alternatively, the attacker sends a PUT or POST request to /wp/v2/users/<id> targeting an existing Administrator's user ID to reset the account password. Either path yields full site takeover from low-privilege access.

The vulnerable code paths are documented in the plugin source at security-hardener.php lines 107, 180, 204, 428, 433, and 439.

Detection Methods for CVE-2026-16149

Indicators of Compromise

Unexpected new user accounts created with the administrator role in wp_users and wp_usermeta tables
POST requests to /wp-json/wp/v2/users originating from low-privilege authenticated sessions
PUT or POST requests to /wp-json/wp/v2/users/<id> targeting existing Administrator user IDs from non-admin sessions
Password reset or email change events on Administrator accounts without corresponding admin activity

Detection Strategies

Audit WordPress access logs for REST API traffic to /wp/v2/users endpoints paired with authenticated non-admin cookies
Monitor the wp_users table for new rows and wp_usermeta for changes to wp_capabilities values
Compare installed plugin versions against 2.4.4 and older to identify vulnerable hosts
Alert on any user creation event where the requester's session role is Subscriber, Contributor, or Author

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized data lake and correlate REST API calls with session role metadata
Build detections on privilege changes and Administrator account additions across the WordPress fleet
Track outbound authentication events tied to newly created accounts to identify follow-on access

How to Mitigate CVE-2026-16149

Immediate Actions Required

Update the Security Hardener plugin to a patched release beyond version 2.4.4 as soon as it is available
If no patch is available, deactivate and remove the Security Hardener plugin from all WordPress sites
Review wp_users for unauthorized Administrator accounts and remove any that are not attributable to legitimate admins
Force password resets for all existing Administrator accounts and rotate application passwords

Patch Information

The vendor addressed the vulnerability in changeset 3630896. Site operators should install the fixed release from the WordPress plugin repository. Additional analysis is available in the Wordfence vulnerability entry.

Workarounds

Disable the Security Hardener plugin until an updated version is deployed
Restrict access to /wp-json/wp/v2/users at the web server or WAF layer to authenticated administrators only
Enforce strong authentication and disable open user registration to reduce the pool of Subscriber-level attackers

bash

# Example nginx rule restricting REST users endpoint to admin IPs
location ~ ^/wp-json/wp/v2/users {
    allow 203.0.113.0/24;
    deny all;
}