CVE-2026-16578 in Admin Safety Guard Plugin
Summary
by MITRE • 08/08/2026
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/08/2026
The vulnerability in question affects the Admin Safety Guard WordPress plugin version 1.3.9 and earlier, representing a critical security flaw that undermines user privacy and system integrity. This issue stems from insufficient capability checks within one of the plugin's REST API endpoints, creating an unauthorized access vector that exposes sensitive user information to unauthenticated attackers. The flaw directly violates fundamental security principles by failing to implement proper authentication and authorization mechanisms before allowing data retrieval operations.
The technical implementation of this vulnerability allows attackers to exploit a specific REST API endpoint without requiring valid credentials or administrative privileges. When exploited, the endpoint returns comprehensive user data including usernames, email addresses, role assignments, and critical two-factor authentication enrollment status information. This exposure creates significant operational risks as adversaries can gather intelligence about system users, identify potential targets for further attacks, and map out the organization's security posture. The vulnerability specifically aligns with CWE-284 Access Control Issues, where insufficient access controls permit unauthorized access to protected resources.
The impact of this vulnerability extends beyond simple information disclosure, creating multiple attack vectors that adversaries can leverage to escalate privileges or conduct targeted attacks. With access to user email addresses and role information, attackers can craft more convincing social engineering campaigns or identify high-value targets within the organization. The exposure of two-factor authentication enrollment status provides additional intelligence about which users may be more secure, potentially guiding attackers to focus on users without multi-factor protection. This vulnerability also aligns with ATT&CK technique T1078 Valid Accounts, as it enables adversaries to gather valid account information without requiring legitimate credentials.
Organizations using affected plugin versions face significant risk of credential harvesting attacks, where the exposed user data can be used to conduct targeted phishing campaigns or brute force attempts against specific accounts. The vulnerability creates a persistent threat surface that remains active until properly patched, potentially allowing attackers to maintain long-term reconnaissance capabilities. Security teams should immediately implement mitigation strategies including updating to version 1.4.0 or later, which includes proper capability checks and authentication requirements for the affected REST API endpoint. Additionally, administrators should review their plugin configurations and consider implementing additional network-level protections such as rate limiting on API endpoints and monitoring for unusual access patterns.
The vulnerability demonstrates the critical importance of implementing proper access control mechanisms within WordPress plugins, particularly those handling sensitive user data or system configuration information. This flaw highlights the need for comprehensive security testing during plugin development cycles, including thorough review of all REST API endpoints for proper authentication and authorization requirements. Organizations should establish robust patch management procedures to ensure timely deployment of security updates, while also conducting regular security audits of installed plugins to identify similar vulnerabilities that may exist in other third-party components.
The exposed user information creates a foundation for more sophisticated attacks including account takeover attempts, where adversaries can leverage the collected intelligence to conduct targeted credential stuffing or password spraying attacks against identified users. The combination of usernames, email addresses, and role information provides attackers with sufficient information to prioritize their attack efforts and increase success rates. Network monitoring should be enhanced to detect unusual API access patterns that may indicate exploitation attempts, while also implementing proper logging mechanisms to track access to sensitive user data endpoints. This vulnerability serves as a reminder that even seemingly minor security flaws can create significant operational risks when they expose user identification and authentication information to unauthorized parties.