CVE-2026-4003: Users manager – PN (WordPress) ≤ 1.1.15 – Unauthenticated Privilege Escalation via 'userspn_form_save' AJAX Action
The Users manager – PN plugin for WordPress contains a missing authorization flaw (CWE-862) in its 'userspn_form_save' AJAX handling, which the record says allows unauthenticated users to update arbitrary user metadata. The record attributes a CVSS 3.1 score of 9.8 (Critical) to the issue, affecting versions up to and including 1.1.15, and lists no fixed version. No confirmed exploitation in the wild appears in the sources consulted.
Overview
The Users manager – PN plugin for WordPress is affected by a missing authorization flaw (CWE-862) that, according to the record, lets unauthenticated requests update user metadata. The record states that all versions up to and including 1.1.15 are affected.
Impact
- According to the record, an unauthenticated attacker could update metadata of any user account, including the userspn_secret_token field.
- The record reports a CVSS 3.1 base score of 9.8 (Critical) from Wordfence, with network access, no privileges and no user interaction required, and high impact on confidentiality, integrity and availability.
- The record links this flaw to account takeover, so affected sites should be treated as high priority.
Affected products and versions
- Product: Felixmartinez Users manager – PN, a WordPress plugin.
- Versions: 1.1.15 and earlier, as listed in the record.
- The record lists no fixed version. This does not confirm that a fix is unavailable.
Exploitation status
- The CISA KEV catalog does not list this CVE in the record.
- No confirmed exploitation in the wild appears in the sources consulted.
- The record gives an SSVC exploitation value of none and an automatable value of yes.
- The record gives an EPSS probability of 0.01315 and a percentile of 0.7002.
Remediation and mitigation
- The record does not identify a patched release. Check the plugin's current status on the WordPress plugin directory and with the vendor before deciding on next steps.
- If the plugin is installed and no fixed release is verified, consider deactivating or removing it until a vendor fix is confirmed.
- Rotate the userspn_secret_token value and review any integrations that depend on it.
- Review user accounts, roles and user metadata for unexpected changes, especially administrator-level accounts.
- Do not treat the nonce check as a protection, because the record states the nonce is exposed to all visitors.
Detection guidance
- Review web server and WordPress logs for requests to the admin AJAX endpoint that reference the userspn_form_save action, particularly from sessions that were not logged in.
- Audit recent changes to user metadata, focusing on fields tied to roles, capabilities or secret tokens.
- Monitor for newly created administrator accounts, unexpected password resets or changes to account email addresses.
Limitations of the available information
- The record provides no fixed version and no vendor advisory text beyond the listed references.
- The CVSS 3.1 score is attributed to Wordfence in the record; no other CVSS source is included.
- The record's source status is Deferred, so the assessment may change as sources are updated.
- The code-path details come from the record and its references; this analysis did not verify them against the plugin source.
Frequently asked questions
Which versions of Users manager – PN are affected?
According to the record, all versions up to and including 1.1.15 are affected by this missing authorization issue.
Is this vulnerability being actively exploited?
The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.
Is there a fixed version available?
The record does not list a fixed version. Check the WordPress plugin directory and the vendor for current status before deciding on next steps.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.