boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-16578HIGH
Unknown Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection — Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0029   21.4     —
AFFECTED
  Product                                                                          Versions  Fixed
  Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection  1.2.7 –   —
TIMELINE
  Jul 22  Reserved by WPScan
  Aug 8   Published (CNA: WPScan)
  Aug 9   EXPLOIT PUBLISHED — CVE-2026-16578 (Unknown Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection). Public exploit reference added.
CWE-200 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

Description

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
July 22, 2026ReservedReserved by WPScan
August 8, 2026PublishedPublished (CNA: WPScan)
August 9, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-16578 (Unknown Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection). Public exploit reference added.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
UnknownAdmin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection—1.2.7—

Weaknesses

CWE-200

References (1)

Related

Authoritative record: CVE-2026-16578 at cve.org

Weaknesses: CWE-200

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-16578 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.