Missing Authorization Vulnerability in Security Hardener Plugin for WordPress

CVE-2026-16149

What is CVE-2026-16149?

The Security Hardener plugin for WordPress contains a vulnerability that allows authenticated attackers to bypass core permission checks. This is due to the plugin's handling of user-enumeration protections, which can be exploited by users with Subscriber-level access or higher. Attackers can create new Administrator accounts or reset existing Administrator passwords by sending specially crafted requests to WordPress REST API endpoints. This security flaw is active by default and presents a significant risk as it strips away important capability checks established by WordPress Core.

References