CVE-2026-16149: Security Hardener WordPress Plugin Bypasses All REST API Authorization

Overview

In an ironic twist on plugin security, the Security Hardener plugin for WordPress — designed to protect sites from common attack vectors — itself introduces a critical Missing Authorization vulnerability (CVSS 8.8) in all versions up to and including 2.4.4.

The plugin's user-enumeration protection feature, enabled by default, hooks the rest_endpoints filter via a secure_user_endpoints() function and overwrites permission callbacks for all REST API endpoints, not just the user-enumeration endpoints it targets. This effectively removes authorization checks from all affected endpoints, allowing unauthenticated or low-privileged users to access REST API routes that should be protected.

Technical Details

Root Cause Analysis

The plugin's intention is to block WordPress user enumeration through the REST API — a legitimate hardening concern, since the /wp-json/wp/v2/users endpoint can expose usernames to attackers.

The implementation hooks rest_endpoints and calls secure_user_endpoints(), which iterates over registered REST API endpoints and modifies their permission_callback values. The bug: the modification is applied too broadly, overwriting callbacks across endpoint groups beyond the intended user-enumeration routes.

The effect is that any WordPress REST endpoint that relies on its registered permission_callback to enforce access control may instead receive a permissive or incorrect callback — functionally disabling authorization for those routes.

What an Attacker Can Access

Depending on the plugins and themes installed, bypassed REST endpoints could include:

• Post creation and editing endpoints (allowing unauthorized content modification)
• Plugin or theme management REST routes
• WooCommerce order/product APIs (on e-commerce sites)
• Custom plugin REST APIs that registered their own permission callbacks
• Any endpoint that assumed its permission_callback would be respected

Attack Surface

Because the user-enumeration protection is enabled by default, every site that has installed Security Hardener and has not explicitly disabled this feature is affected immediately upon activation — with no additional configuration required from the attacker.

Affected Systems

All WordPress installations with Security Hardener version 2.4.4 or earlier and the default user-enumeration protection enabled.

Impact Assessment

Exploitation allows attackers to:

1. Bypass REST API authorization for any affected endpoint without valid credentials
2. Modify content (posts, pages, custom post types) via unauthorized API calls
3. Access protected data exposed by other plugins' REST endpoints
4. Perform privileged operations through routes that expected authentication
5. Abuse e-commerce or membership functionality on sites with relevant plugins

The CVSS 8.8 score reflects the high impact, network-accessible attack vector, and lack of authentication requirement for many of the newly-exposed endpoints.

Recommended Mitigations

1. Update Security Hardener — upgrade to a patched version immediately; monitor the plugin's WordPress.org page for the fix release
2. Temporarily deactivate the plugin — if a patch is not yet available and you cannot tolerate the risk, deactivate Security Hardener until patched (you lose its other protections, but remove the active vulnerability)
3. Disable user-enumeration protection — as a temporary middle ground, if the plugin provides a toggle to disable the secure_user_endpoints() feature, disable it until a patch is available
4. Deploy WAF rules — restrict direct REST API access from untrusted sources at the WAF or reverse proxy level
5. Monitor REST API access logs — review recent access to /wp-json/ endpoints for unusual activity that may indicate exploitation

Broader Lessons

This vulnerability is a cautionary example of the Confused Deputy Problem in security tooling: a plugin granted broad privileges to "protect" the system inadvertently removes the protections it was meant to enforce. It also highlights why:

• Security plugins should be subjected to the same rigorous security review as any other plugin
• Features that modify core WordPress behavior globally (via broad filter hooks) require careful scoping
• Default-enabled security features carry higher risk surface than opt-in ones, since every installation is immediately affected

WordPress site operators should periodically audit installed security plugins for vulnerabilities, as these plugins are high-value targets precisely because of their elevated access to WordPress internals.

References

• NVD Entry: CVE-2026-16149
• CWE-862: Missing Authorization
• WordPress REST API Handbook: Permission Callbacks