CVE-2026-16578 Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route
Unauthenticated attackers can retrieve registered user data including emails and 2FA status via an unprotected REST API endpoint in the Admin Safety Guard plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16578?
CVE-2026-16578 is a high-severity missing authorization vulnerability in Unknown Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection, published on 8 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
Weakness: CWE-200
Which versions are affected by CVE-2026-16578?
How do I fix CVE-2026-16578?
No fix has been published for CVE-2026-16578 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-16578 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-16578 exists.
Sources
Also known as GHSA-wcvm-4w3j-r33j.