CVE-2026-4003 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-4003 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-4003 is a privilege escalation vulnerability in the "Users manager – PN" plugin for WordPress, affecting all versions up to and including 1.1.15, caused by flawed authorization logic that permits arbitrary user meta updates.

Technical Detail

The flaw resides in the plugin's authorization logic, which fails to properly validate whether a requesting user has the rights to modify user meta fields. An attacker, potentially with low or no authenticated access, can exploit this weakness to write arbitrary values to user meta records, enabling elevation of their own account to administrator-level privileges. The practical impact is full WordPress site compromise, as administrator access grants control over content, installed plugins, themes, and underlying server interactions through the admin interface.

Exploitation Status

No known exploit code has been publicly identified at this time, and this CVE is not currently listed in CISA's Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit; however, the vulnerability class is well understood and the attack surface is broad given the prevalence of WordPress deployments, meaning weaponization risk should not be dismissed.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence. Opportunistic actors routinely scan for vulnerable WordPress plugins at scale, so exposure should be treated as a realistic near-term risk even in the absence of confirmed attribution.

What To Do

Administrators running the "Users manager – PN" plugin should update to a patched version immediately if one has been released by the vendor, or deactivate and remove the plugin until a fix is confirmed available. Given the critical CVSS score of 9.8 and the nature of the flaw, this should be treated as a high-priority remediation item. Site operators should audit user accounts and user meta records for unauthorized modifications as a detection measure, and review WordPress admin logs for unexpected privilege changes. If the plugin cannot be removed or patched, consider restricting access to the WordPress admin interface via IP allowlisting as a temporary compensating control.