Admin Safety Guard Login Security Limit Logins 2Fa Brute Force Protection
Monthly
Unauthenticated user enumeration in the Admin Safety Guard WordPress plugin (versions before 1.4.0) exposes the full registered user list - including usernames, email addresses, assigned roles, and two-factor authentication enrollment status - to any unauthenticated HTTP caller via an unprotected REST API endpoint. The irony is significant: a plugin marketed specifically for login security and brute-force protection inadvertently facilitates credential-stuffing and targeted attack preparation by leaking the exact user data attackers need. A publicly available proof-of-concept exploit exists, though EPSS sits at only 0.18% and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Unauthenticated user enumeration in the Admin Safety Guard WordPress plugin (versions before 1.4.0) exposes the full registered user list - including usernames, email addresses, assigned roles, and two-factor authentication enrollment status - to any unauthenticated HTTP caller via an unprotected REST API endpoint. The irony is significant: a plugin marketed specifically for login security and brute-force protection inadvertently facilitates credential-stuffing and targeted attack preparation by leaking the exact user data attackers need. A publicly available proof-of-concept exploit exists, though EPSS sits at only 0.18% and CISA has not added this to the Known Exploited Vulnerabilities catalog.