Loading vulnerability…
Unauthenticated Arbitrary User Meta Update Privilege Escalation in Users manager – PN for WordPress
CVE-2026-4003 is a missing-authorization vulnerability in the Users manager – PN WordPress plugin affecting all versions up to and including 1.1.15. The flaw is in the userspn_ajax_nopriv_server() function, specifically the userspn_form_save AJAX action handler. The authorization logic only rejects unauthenticated requests when the supplied user_id is empty; if an attacker provides a non-empty user_id, execution bypasses the intended restriction and proceeds to update arbitrary user metadata through update_user_meta() without proper authentication or authorization checks. The issue is compounded by the plugin exposing the required userspn-nonce to all visitors via wp_localize_script on the public wp_enqueue_scripts hook, which makes the nonce ineffective as a meaningful access control. As a result, an unauthenticated attacker can send a crafted request to modify metadata for arbitrary accounts, including sensitive fields such as userspn_secret_token, creating a direct path to account takeover.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows completely unauthenticated attackers to overwrite arbitrary user metadata for any targeted WordPress user account, including administrator accounts. Because sensitive fields such as userspn_secret_token can be modified, the vulnerability can directly enable full account takeover and privilege escalation to administrative access. The provided context also assigns a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If an immediate update is not possible, disable or remove the Users manager – PN plugin until a fixed version can be deployed. Restrict public access to the vulnerable AJAX action if feasible, and monitor for unauthorized changes to user metadata, especially high-value fields such as userspn_secret_token and administrator-associated profile/meta values. Because the nonce is exposed publicly, rotating or hiding the nonce alone is not a sufficient mitigation unless the underlying authorization flaw is corrected.
Patch, then assume compromise.
Update the Users manager – PN plugin to a fixed version. The provided content indicates that versions up to and including 1.1.15 are vulnerable and that the vendor reportedly addressed the issue in version 1.1.20. If that fixed version is available, upgrade to 1.1.20 or later. Additionally, ensure the vulnerable AJAX handler enforces both authentication and authorization before allowing any user metadata updates, and do not rely on publicly exposed nonces as an access-control mechanism.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.