Junglewise Threat Intelligence

CVE-2026-4003: felixmartinez Users manager , PN privilege escalation via user meta update

CVE-2026-4003 · Severity: critical · CVSS 9.8 · Published 2026-04-08

Executive brief

The Users manager – PN plugin for WordPress, which is used to manage user profiles and metadata, contains a critical security flaw. This vulnerability allows an unauthenticated attacker to modify account information for any user on the site, including administrators. By changing sensitive account data, an attacker can gain full administrative control over the website, leading to total data exposure or site takeover.

Technical details

The Users manager – PN plugin for WordPress suffers from a missing authorization vulnerability in the userspn_ajax_nopriv_server() function. The 'userspn_form_save' case contains flawed logic that only validates the presence of a user_id rather than the authorization of the requester; if a non-empty user_id is provided, the function proceeds to call update_user_meta() without further checks. Furthermore, the 'userspn-nonce' required for the AJAX request is leaked to all visitors via wp_localize_script, bypassing intended CSRF protections. An unauthenticated remote attacker can exploit this to modify arbitrary user metadata, such as secret tokens or roles, leading to full site compromise.

Affected products

  • felixmartinez Users manager – PN <= 1.1.15

Timeline

  • 2026-04-08: disclosed
  • 2026-04-08: advisory

References