The Security Hardener plugin for WordPress has a missing authorization flaw that overwrites the permission callbacks for the REST API routes /wp/v2/users and /wp/v2/users/<id>. This blanket change removes WordPress Core's capability checks, allowing any authenticated user who has at least Subscriber-level access to perform actions that normally require higher privileges. As a result, an attacker can create new accounts with Administrator role or reset the password of an existing Administrator by sending POST or PUT requests to those endpoints.

All installations of the Security Hardener plugin for WordPress up to and including version 2.4.4. WordPress sites that have the plugin installed and have the block_user_enum option enabled (the default). No other versions are affected.

The vulnerability carries a CVSS score of 8.8, indicating a high severity and potential for significant impact if exploited. Because the plugin overwrites permission callbacks on every request after installation, no special configuration is required, and the flaw can be exploited by any authenticated user with minimum Subscriber rights. Although EPSS data is not available, the lack of an authorization check makes exploitation straightforward. The vulnerability is not listed in CISA's KEV catalog, but it remains a serious risk for affected sites. The attack vector is expected to be through authenticated API requests to the WordPress REST interface, which are common for site developers and administrators.