What is the CVSS score of EUVD-2026-54737?

EUVD-2026-54737 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Admin Safety Guard are affected by EUVD-2026-54737?

Admin Safety Guard WordPress plugin versions before 1.4.0 exposes your complete user directory-usernames, email addresses, assigned roles, and 2FA status-to any unauthenticated internet caller…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-54737?

Yes, a public proof-of-concept exploit is available for EUVD-2026-54737. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-54737?

Within 24 hours: audit all WordPress installations for Admin Safety Guard plugin presence and version number. Within 7 days: update all instances to version 1.4.0 or later, then review web server and WordPress logs for suspicious queries to /wp-json endpoints or user enumeration patterns between the plugin's installation date and patch application date. Within 30 days: assess the exposure window by cross-referencing detected API access against known phishing or credential-stuffing campaigns targeting your domain, reset passwords for any accounts showing concurrent suspicious login attempts, and document the incident timeline in your vulnerability management system.

Admin Safety Guard EUVD-2026-54737

| CVE-2026-16578 HIGH

Information Exposure (CWE-200)

2026-08-08 WPScan

GHSA-wcvm-4w3j-r33j

WordPress Information Disclosure Admin Safety Guard Login Security Limit Logins 2Fa Brute Force Protection Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable REST endpoint requires no authentication, no complexity, and exposes only confidentiality with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 22:37 vuln.today

CVSS changed

Aug 10, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

Aug 08, 2026 - 07:01 EUVD

CVE Published

Aug 08, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 08, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Admin Safety Guard - Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.

AnalysisAI

Unauthenticated user enumeration in the Admin Safety Guard WordPress plugin (versions before 1.4.0) exposes the full registered user list - including usernames, email addresses, assigned roles, and two-factor authentication enrollment status - to any unauthenticated HTTP caller via an unprotected REST API endpoint. The irony is significant: a plugin marketed specifically for login security and brute-force protection inadvertently facilitates credential-stuffing and targeted attack preparation by leaking the exact user data attackers need. A publicly available proof-of-concept exploit exists, though EPSS sits at only 0.18% and CISA has not added this to the Known Exploited Vulnerabilities catalog.

Technical ContextAI

WordPress exposes a REST API framework that plugin authors can extend with custom endpoints. Proper access control requires registering a 'permission_callback' that enforces WordPress capability checks (e.g., current_user_can()). The root cause - CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - manifests here because one of the plugin's REST API endpoints registers a permission callback that always returns true, or omits the callback entirely, bypassing WordPress's built-in authentication layer. The affected CPE is cpe:2.3:a:unknown:admin_safety_guard_login_security,_limit_logins,_2fa_brute_force_protection:*:*:*:*:*:*:*:* for versions before 1.4.0. The leaked 2FA enrollment status is a secondary risk: defenders deploying this plugin to harden WordPress sites may have a false sense of security regarding which accounts are MFA-protected, while attackers can now preferentially target accounts that are not enrolled in 2FA.

RemediationAI

Update the Admin Safety Guard plugin to version 1.4.0 or later, which is confirmed as the patched release per the vendor advisory and WPScan disclosure at https://wpscan.com/vulnerability/c02393ee-1ade-433e-bbd0-c09785e5c426/. The update can be applied through the WordPress admin dashboard under Plugins > Installed Plugins > Update. If an immediate update is not feasible, a compensating control is to deactivate the plugin entirely, which removes the vulnerable REST API endpoint from the attack surface - the trade-off is losing brute-force protection and 2FA enforcement until the plugin is re-enabled. Alternatively, a WAF rule blocking unauthenticated requests to the specific plugin REST API namespace (typically /wp-json/<plugin-namespace>/) can reduce exposure without a full deactivation, though this requires knowing the exact endpoint path. Site operators should also audit their WordPress user list for any accounts that were not enrolled in 2FA prior to patch application, as the leaked enrollment status may have already been collected by attackers.