A Missing Authorization vulnerability in the Security Hardener plugin for WordPress allows low-privileged users to perform administrative actions, undermining the security of the site.

This vulnerability is categorized as Missing Authorization (CWE-269), where the plugin fails to perform adequate capability checks on sensitive functions. This allows authenticated users with low privileges to invoke administrative-level actions.

With a CVSS score of 8.8, this flaw is critical because it negates the purpose of the security plugin itself. An attacker who gains low-level access can potentially modify security settings, disable protections, or escalate their privileges, leading to full control over the WordPress installation.

Immediate Action: Update the Security Hardener plugin to version 2.4.5 or later.

Proactive Monitoring: Audit WordPress user roles and permissions, and monitor the Security Hardener logs for any administrative changes initiated by non-administrative user accounts.

Compensating Controls: Restrict access to the WordPress administrative interface to trusted IP addresses using a WAF or server-level access control list.

Public Exploit Available: Unknown

The irony of a security plugin introducing a vulnerability that leads to privilege escalation is significant. Organizations must treat this update with high priority to ensure that the security controls provided by the plugin are not bypassed by unauthorized actors.