What’s Vulnerable › Vulnerabilities
CVE-2026-16578: Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-08 · updated 2026-08-26
- Weakness: CWE-200
Description
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
Affected products
- Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection: from 1.2.7 before 1.4.0 — fixed in 1.4.0
How to fix
Upgrade to a fixed version: Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection 1.4.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-16578 or the next vulnerability affects your stack