CVE-2026-16578: WordPress Admin Safety Guard Plugin Flaw

CVE-2026-16578 Overview

CVE-2026-16578 affects the Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin in versions before 1.4.0. The plugin exposes a REST API endpoint without any capability check. Unauthenticated attackers can query this endpoint to retrieve the complete list of registered users. The disclosed data includes usernames, email addresses, assigned roles, and two-factor authentication enrollment status. The vulnerability maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can enumerate all WordPress user accounts, harvest email addresses, identify administrator roles, and target accounts without 2FA for follow-on credential attacks.

Affected Products

Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection (WordPress plugin)
All versions prior to 1.4.0
WordPress sites with the plugin installed and active

Discovery Timeline

2026-08-08 - CVE-2026-16578 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-16578

Vulnerability Analysis

The Admin Safety Guard plugin registers a REST API endpoint intended for administrative use. The endpoint returns the site's full user directory but omits the permission_callback capability check required by the WordPress REST API framework. Any HTTP client can call the endpoint anonymously and receive the response.

The returned payload contains username, email address, role assignment, and 2FA enrollment status for every registered user. Attackers gain a targeting map of the site: which accounts hold administrator privileges, which email addresses are valid for phishing, and which accounts lack 2FA and are viable for credential stuffing or brute force attacks. The irony is direct — a plugin marketed as brute force protection provides attackers the exact reconnaissance data needed to bypass it.

Root Cause

The root cause is a missing authorization check on a REST API route. WordPress requires plugin developers to define a permission_callback when registering routes with register_rest_route(). When this callback is absent or returns true without validating capabilities, the endpoint is publicly accessible. The affected endpoint should have verified the caller possesses the list_users or manage_options capability before returning user records.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends a single HTTP GET request to the vulnerable REST API route. No authentication, session, or user interaction is required. The response returns structured JSON containing the user directory. The attack is scriptable, silent, and leaves only standard web server access log entries. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-16578

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/ REST API routes associated with the Admin Safety Guard plugin
Access log entries showing large or repeated responses from plugin REST endpoints to external IPs
Spikes in phishing emails targeting addresses that only exist in the WordPress user database
Login attempts concentrated on accounts that lack 2FA enrollment

Detection Strategies

Audit access.log for anonymous requests to plugin-specific /wp-json/ paths and correlate with source IP reputation
Inspect the plugin's register_rest_route() calls for missing or permissive permission_callback values
Alert on REST API responses exceeding size thresholds when the requester is unauthenticated

Monitoring Recommendations

Enable REST API request logging on the web server or via a WordPress security plugin
Monitor for outbound reconnaissance patterns targeting /wp-json/ endpoints across your WordPress fleet
Track failed login volume against accounts identified as high-value (administrator role, no 2FA)

How to Mitigate CVE-2026-16578

Immediate Actions Required

Update the Admin Safety Guard plugin to version 1.4.0 or later on all WordPress installations
Enforce 2FA enrollment for all administrator and editor accounts
Rotate email addresses or notify users whose data may have been exposed to prepare them for targeted phishing
Review web server logs for prior unauthenticated access to the vulnerable REST endpoint

Patch Information

The vendor released version 1.4.0 of the Admin Safety Guard plugin, which adds a capability check to the affected REST API endpoint. Site administrators should update through the WordPress plugin dashboard or via WP-CLI. Reference the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the Admin Safety Guard plugin until the update to 1.4.0 can be applied
Restrict access to /wp-json/ REST API routes at the web application firewall or reverse proxy layer for unauthenticated clients
Use a WordPress security plugin or .htaccess rules to block anonymous requests to plugin-specific REST endpoints

bash

# Example: block unauthenticated access to the plugin REST namespace via nginx
location ~* /wp-json/admin-safety-guard/ {
    if ($http_authorization = "") {
        return 403;
    }
}