CVE-2026-4003
Published: 08 April 2026
Description
The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15. This is due to a flawed authorization logic check in the userspn_ajax_nopriv_server() function within…
more
the 'userspn_form_save' case. The conditional only blocks unauthenticated users when the user_id is empty, but when a non-empty user_id is supplied, execution bypasses this check entirely and proceeds to update arbitrary user meta via update_user_meta() without any authentication or authorization verification. Additionally, the nonce required for this AJAX endpoint ('userspn-nonce') is exposed to all visitors via wp_localize_script on the public wp_enqueue_scripts hook, rendering the nonce check ineffective as a security control. This makes it possible for unauthenticated attackers to update arbitrary user metadata for any user account, including the userspn_secret_token field.
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations before allowing updates to user metadata, directly preventing the flawed authorization bypass in the AJAX handler.
Applies least privilege to ensure unauthenticated users cannot perform privileged actions like arbitrary user meta updates, mitigating the privilege escalation.
Limits specific actions performable without identification or authentication, prohibiting unauthenticated updates to sensitive user metadata such as the secret token.
Security SummaryAI
CVE-2026-4003 is a privilege escalation vulnerability in the Users manager – PN plugin for WordPress, affecting all versions up to and including 1.1.15. The issue stems from flawed authorization logic in the userspn_ajax_nopriv_server() function, specifically within the 'userspn_form_save' case. This conditional check only blocks unauthenticated users when the user_id is empty, allowing execution to bypass verification entirely for non-empty user_id values and proceed to update arbitrary user meta via update_user_meta() without authentication or authorization. Compounding the problem, the required nonce ('userspn-nonce') for this AJAX endpoint is exposed to all visitors through wp_localize_script on the public wp_enqueue_scripts hook, rendering the nonce check ineffective.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity, requiring no privileges or user interaction. By supplying a non-empty user_id, they can update arbitrary user metadata for any account, including the sensitive userspn_secret_token field, potentially enabling further compromise such as session hijacking or administrative privilege escalation. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-862 (Missing Authorization).
The provided references point to specific lines in the plugin's source code on the WordPress plugins trac repository for tag 1.0.31, including the vulnerable authorization check in class-userspn-ajax-nopriv.php (lines 186, 190, 233), the update_user_meta call in class-userspn-common.php (line 168), and related user functions in class-userspn-functions-user.php (line 235). No explicit patch or mitigation details are detailed in the available information.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote exploit in a public-facing WordPress plugin (T1190), classified as privilege escalation (T1068), enabling arbitrary user metadata updates for account manipulation (T1098).