What is the CVSS score of CVE-2026-4003?

CVE-2026-4003 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Users Manager Pn are affected by CVE-2026-4003?

The Users Manager - PN plugin for WordPress versions 1.1.15 and earlier contains a critical authentication bypass vulnerability (CVSS 9.8) that enables unauthenticated attackers to modify user…

How to fix or mitigate CVE-2026-4003?

Within 24 hours: identify all WordPress instances running Users Manager - PN plugin and disable or deactivate the plugin immediately as a temporary measure; document affected installations. Within 7 days: contact the plugin vendor for patch availability and timeline; if no patch is released, evaluate alternative user management solutions. Within 30 days: either deploy a vendor-released patch to version 1.1.16 or later, or replace the plugin entirely with a maintained alternative and verify all user accounts for unauthorized modifications.

Users Manager Pn CVE-2026-4003

EUVD-2026-20043 CRITICAL

Missing Authorization (CWE-862)

2026-04-08 Wordfence

GHSA-f474-j5g7-2pch

WordPress Authentication Bypass Privilege Escalation Users Manager Pn Wordpress Plugin

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 04:30 euvd

EUVD-2026-20043

Analysis Generated

Apr 08, 2026 - 04:30 vuln.today

CVE Published

Apr 08, 2026 - 03:36 nvd

CRITICAL 9.8

DescriptionCVE.org

The Users manager - PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15. This is due to a flawed authorization logic check in the userspn_ajax_nopriv_server() function within the 'userspn_form_save' case. The conditional only blocks unauthenticated users when the user_id is empty, but when a non-empty user_id is supplied, execution bypasses this check entirely and proceeds to update arbitrary user meta via update_user_meta() without any authentication or authorization verification. Additionally, the nonce required for this AJAX endpoint ('userspn-nonce') is exposed to all visitors via wp_localize_script on the public wp_enqueue_scripts hook, rendering the nonce check ineffective as a security control. This makes it possible for unauthenticated attackers to update arbitrary user metadata for any user account, including the userspn_secret_token field.

AnalysisAI

Arbitrary user metadata modification in Users Manager - PN plugin for WordPress (versions ≤1.1.15) allows unaneticated remote attackers to escalate privileges and hijack accounts. The vulnerability stems from flawed authorization logic in userspn_ajax_nopriv_server() that fails to verify authentication when user_id is supplied, combined with publicly exposed nonce values. Attackers can modify critical user metadata including userspn_secret_token for any WordPress user. CVSS 9.8 (Critical). EPSS data not available. No public exploit identified at time of analysis, but exploitation requires only HTTP requests with predictable parameters.

Technical ContextAI

This vulnerability affects the Users Manager - PN WordPress plugin (cpe:2.3:a:felixmartinez:users_manager_-_pn:*:*:*:*:*:*:*:*), specifically versions through 1.1.15. The root cause is CWE-862 (Missing Authorization), where the AJAX handler userspn_ajax_nopriv_server() implements a conditional check that only validates authentication when user_id is empty. When a non-empty user_id parameter is provided, the function bypasses authorization entirely and proceeds directly to update_user_meta(), WordPress's core function for modifying user metadata. Compounding this flaw, the plugin exposes the required AJAX nonce ('userspn-nonce') to all site visitors via wp_localize_script on the public wp_enqueue_scripts hook, defeating the intended CSRF protection. The vulnerability allows manipulation of arbitrary user meta keys, including security-sensitive fields like userspn_secret_token. The affected code resides in class-userspn-ajax-nopriv.php within the 'userspn_form_save' case handler, with related vulnerable patterns observable in class-userspn-common.php and class-userspn-functions-user.php.

RemediationAI

Immediately update Users Manager - PN plugin to version 1.1.16 or later, which addresses this vulnerability per the Wordfence advisory and plugin repository changeset 3491109. Site administrators should verify the update via WordPress admin dashboard (Plugins > Installed Plugins) or manually via FTP/SFTP by replacing the /wp-content/plugins/userspn/ directory with the patched version from wordpress.org. If immediate patching is not feasible, temporarily deactivate and delete the plugin until updates can be applied, as no effective workaround exists for unauthenticated exploitation. After patching, conduct a security audit to identify any suspicious user metadata modifications or unauthorized privilege escalations that may have occurred while the vulnerability was present. Review user accounts for unexpected role changes, metadata alterations, or newly created administrative accounts. The fix implements proper authentication and capability checks before allowing user metadata updates. Consult the complete vulnerability analysis at https://www.wordfence.com/threat-intel/vulnerabilities/id/27bb60c1-43fa-4a18-b9ca-059535b0d5b6 and monitor plugin repository changesets for implementation details.