EUVD-2026-20043
GHSA-f474-j5g7-2pch
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend AJAX request to userspn_form_save
-
ExploitBypass authorization check with non-empty user_id
-
ExecutionCall update_user_meta() without verification
-
ImpactEscalate privileges to administrator
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | WordPress installation with Users manager - PN plugin versions up to 1.1.15 enabled. Remote unauthenticated attacker can exploit via AJAX endpoint 'userspn_form_save' by supplying a non-empty user_id parameter to bypass authorization checks and update arbitrary user metadata. |
| Impact | This represents a critical real-world risk despite absence of confirmed active exploitation. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with low complexity requiring no authentication or user interaction, yielding complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The attack is trivially automatable: adversaries need only craft HTTP POST requests to the exposed AJAX endpoint with publicly available nonce values and target user_id parameters. While no public exploit identified at time of analysis and no CISA KEV listing exists, the technical barriers to exploitation are minimal. WordPress sites using this plugin for user management are immediately vulnerable to account takeover via metadata manipulation, privilege escalation to administrator roles, and potential site-wide compromise. The publicly exposed nonce values eliminate CSRF protections, and the ability to modify userspn_secret_token metadata suggests authentication bypass mechanisms. SSVC analysis indicates high technical impact (total control of user accounts), automatable exploitation (simple HTTP requests), and efficient attack diffusion potential given WordPress's ubiquity. This vulnerability should be prioritized for immediate remediation regardless of EPSS score availability. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running Users Manager - PN plugin version 1.1.15 or earlier through version enumeration or plugin detection tools. The attacker crafts an HTTP POST request to /wp-admin/admin-ajax.php with action=userspn_form_save, retrieves the publicly exposed userspn-nonce value from the site's JavaScript localization data, and includes a user_id parameter targeting the site administrator (typically user ID 1). By manipulating the userspn_secret_token or other metadata fields via the request, the attacker bypasses authentication mechanisms, escalates their privileges to administrator level, or gains unauthorized access to user accounts. The attacker could then install malicious plugins, inject backdoors, exfiltrate sensitive data, or completely compromise the WordPress installation without ever authenticating to the site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Arbitrary user metadata modification in Users Manager - PN plugin for WordPress (versions ≤1.1.15) allows unaneticated remote attackers to escalate privileges and hijack accounts. The vulnerability stems from flawed authorization logic in userspn_ajax_nopriv_server() that fails to verify authentication when user_id is supplied, combined with publicly exposed nonce values. Attackers can modify critical user metadata including userspn_secret_token for any WordPress user. CVSS 9.8 (Critical). EPSS data not available. No public exploit identified at time of analysis, but exploitation requires only HTTP requests with predictable parameters.
RemediationAI
Immediately update Users Manager - PN plugin to version 1.1.16 or later, which addresses this vulnerability per the Wordfence advisory and plugin repository changeset 3491109. Site administrators should verify the update via WordPress admin dashboard (Plugins > Installed Plugins) or manually via FTP/SFTP by replacing the /wp-content/plugins/userspn/ directory with the patched version from wordpress.org. If immediate patching is not feasible, temporarily deactivate and delete the plugin until updates can be applied, as no effective workaround exists for unauthenticated exploitation. After patching, conduct a security audit to identify any suspicious user metadata modifications or unauthorized privilege escalations that may have occurred while the vulnerability was present. Review user accounts for unexpected role changes, metadata alterations, or newly created administrative accounts. The fix implements proper authentication and capability checks before allowing user metadata updates. Consult the complete vulnerability analysis at https://www.wordfence.com/threat-intel/vulnerabilities/id/27bb60c1-43fa-4a18-b9ca-059535b0d5b6 and monitor plugin repository changesets for implementation details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Users Manager - PN WordPress plugin (cpe:2.3:a:felixmartinez:users_manager_-_pn:*:*:*:*:*:*:*:*), specifically versions through 1.1.15. The root cause is CWE-862 (Missing Authorization), where the AJAX handler userspn_ajax_nopriv_server() implements a conditional check that only validates authentication when user_id is empty. When a non-empty user_id parameter is provided, the function bypasses authorization entirely and proceeds directly to update_user_meta(), WordPress's core function for modifying user metadata. Compounding this flaw, the plugin exposes the required AJAX nonce ('userspn-nonce') to all site visitors via wp_localize_script on the public wp_enqueue_scripts hook, defeating the intended CSRF protection. The vulnerability allows manipulation of arbitrary user meta keys, including security-sensitive fields like userspn_secret_token. The affected code resides in class-userspn-ajax-nopriv.php within the 'userspn_form_save' case handler, with related vulnerable patterns observable in class-userspn-common.php and class-userspn-functions-user.php.
Know when Users Manager Pn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Users manager - PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15. This is due to a flawed authorization logic check in the userspn_ajax_nopriv_server() function within the 'userspn_form_save' case. The conditional only blocks unauthenticated users when the user_id is empty, but when a non-empty user_id is supplied, execution bypasses this check entirely and proceeds to update arbitrary user meta via update_user_meta() without any authentication or authorization verification. Additionally, the nonce required for this AJAX endpoint ('userspn-nonce') is exposed to all visitors via wp_localize_script on the public wp_enqueue_scripts hook, rendering the nonce check ineffective as a security control. This makes it possible for unauthenticated attackers to update arbitrary user metadata for any user account, including the userspn_secret_token field.
Executive ViewAI
The Users Manager - PN plugin for WordPress versions 1.1.15 and earlier contains a critical authentication bypass vulnerability (CVSS 9.8) that enables unauthenticated attackers to modify user metadata, escalate privileges, and hijack any WordPress account on affected sites. Organizations running this plugin face immediate risk of account takeover and administrative compromise without requiring credentials.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the Users Manager - PN plugin entirely until patch availability is confirmed; (2) If operational necessity requires the plugin, implement Web Application Firewall (WAF) rules to block requests to userspn_ajax_nopriv_server() endpoints; (3) Restrict WordPress administrator access to a protected network segment; (4) Audit user metadata and account permissions for unauthorized changes; (5) Monitor for suspicious AJAX requests and metadata modifications in WordPress logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB