CVE-2026-16578CWE-200information-disclosure

CVE-2026-16578

High · published August 8, 2026

CVSS v3.1

7.5

EPSS

Percentile

41.7

In the wild

Unconfirmed

What it is

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00496 · 41.7th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2026-08-08T11:17Z

References (1)

https://wpscan.com/vulnerability/c02393ee-1ade-433e-bbd0-c09785e5c426/ · [email protected]

EPSS history

Timeline

08 AUG 06:00Z
Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route
cvelistv5