{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-16149 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-16149 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-16149 is a high-severity missing authorization vulnerability in marc4 Security Hardener, published on 22 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-16149 and fix it if it is affected.\n\nWhat it is: CVE-2026-16149 is a high-severity missing authorization vulnerability in marc4 Security Hardener, published on 22 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-16149 in the wild and no public exploit code.\n\nAffected product: marc4 Security Hardener. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-16149/ (Markdown: https://insights.sbomify.com/CVE-2026-16149/index.md)","id":"CVE-2026-16149","markdown":"https://insights.sbomify.com/CVE-2026-16149/index.md","name":"CVE-2026-16149","record":{"aliases":["GHSA-493r-g3qv-5457"],"analysis":{"component_type":"cms_plugin","fix_type":"patch","impacts":["privilege_escalation","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"WordPress plugin","requires_auth":"low_privilege","summary":"Authenticated subscribers can escalate privileges to Administrator by exploiting missing authorization checks in the Security Hardener plugin's REST API handlers.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Wordfence","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"description":"The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the rest_endpoints filter via secure_user_endpoints() and overwrites every registered handler's permission_callback on both the /wp/v2/users and /wp/v2/users/(?P\u003cid\u003e[\\d]+) routes — including POST, PUT, PATCH, and DELETE handlers — with a bare closure that returns only is_user_logged_in(), completely stripping WordPress Core's original capability checks such as create_users, promote_user, edit_users, and delete_users that WP_REST_Users_Controller normally enforces. This makes it possible for authenticated attackers with Subscriber-level access and above to create new Administrator accounts by sending POST request to /wp/v2/users with administrator role, or to reset an existing Administrator's password by issuing a PUT/POST request to /wp/v2/users/\u003cid\u003e. Because the block_user_enum option defaults to enabled, no special plugin configuration is required — the overwrite is active on every request as soon as the plugin is installed.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Missing authorization in Security Hardener","id":"CVE-2026-16149","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution","id":"CVE-2026-16150"},"packages":[],"prev":{"headline":"Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item","id":"CVE-2026-16148"},"products":["Security Hardener"],"published":"2026-08-22","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-24","vendors":["marc4"]},"summary":"Authenticated subscribers can escalate privileges to Administrator by exploiting missing authorization checks in the Security Hardener plugin's REST API handlers.","url":"https://insights.sbomify.com/CVE-2026-16149/"}