Security Hardener

CVE-2026-16149 is a high-severity Security Hardener flaw where user-enumeration protection can overwrite WordPress REST user endpoint capability checks, allowing Subscriber-level users to perform privileged user actions. Update to 2.4.5 immediately.

Wordfence Intelligence published CVE-2026-16149 on August 22, 2026 for Security Hardener, a WordPress hardening plugin with 200+ active installations. The flaw is serious because it affects the plugin’s own user-enumeration protection, a default hardening feature that is intended to protect REST user endpoints.

In affected versions, the plugin hooks the WordPress REST endpoint registry and changes the permission callback for the core /wp/v2/users routes. The result is that normal WordPress capability checks for creating, editing, promoting, or deleting users can be replaced by a much weaker logged-in check.

Table of Contents

Vulnerability Summary

Plugin: Security Hardener
Slug: security-hardener
CVE: CVE-2026-16149
Severity: CVSS 8.8 high
Attack class: improper privilege management / missing authorization
Required access: authenticated Subscriber-level account or higher
Affected versions: all versions up to and including 2.4.4
Fixed version: 2.4.5

What Goes Wrong

Security Hardener includes a REST user-enumeration protection feature. According to Wordfence, that feature is enabled by default and uses the rest_endpoints filter through the plugin’s user endpoint hardening code. Instead of only tightening public user enumeration, vulnerable versions can overwrite the permission callbacks for both collection and single-user REST routes.

WordPress core normally requires strong capabilities such as create_users, promote_user, edit_users, and delete_users before allowing privileged user operations. If those callbacks are replaced with a logged-in-only check, a low-privilege user may reach administrator-level user management behavior.

Immediate Fix

Update Security Hardener to 2.4.5 or newer.
If you cannot update immediately, deactivate Security Hardener until the patched build is deployed.
Review all administrator accounts for unexpected users, email changes, and recent password resets.
Invalidate active sessions if any suspicious account change is found.
Review access logs for unexpected authenticated writes to WordPress REST user endpoints.

WP-CLI Checks

wp plugin get security-hardener --fields=name,version,status
wp plugin update security-hardener
wp plugin get security-hardener --field=version

Use a read-only administrator account review after patching. The first query lists administrator users, and the second highlights accounts created during the last 14 days.

wp db query "SELECT u.ID,u.user_login,u.user_email,u.user_registered FROM {prefix}users u JOIN {prefix}usermeta m ON m.user_id=u.ID WHERE m.meta_key='{prefix}capabilities' AND m.meta_value LIKE '%administrator%';"
wp db query "SELECT ID,user_login,user_email,user_registered FROM {prefix}users WHERE user_registered >= DATE_SUB(NOW(), INTERVAL 14 DAY);"

Temporary Mitigation

The recommended mitigation is the vendor patch. If patching has to wait, deactivate the plugin or block authenticated non-administrator write methods to /wp-json/wp/v2/users at the edge. Test any edge rule before production deployment because legitimate admin workflows and integrations can use the REST users endpoint.

# Conceptual WAF rule, not a replacement for updating:
# if path starts with '/wp-json/wp/v2/users'
# and method in POST, PUT, PATCH, DELETE
# and requester is not an approved administrator context:
#     block or challenge