CyberRota Analysis
AI-GeneratedThe Admin Safety Guard plugin for WordPress versions prior to 1.4.0 is vulnerable due to a lack of capability checks on a REST API endpoint, enabling unauthenticated attackers to access sensitive information about registered users, including usernames, email addresses, roles, and two-factor authentication statuses. This exposure can lead to user impersonation and targeted attacks. WordPress site administrators using this plugin should prioritize immediate updates to mitigate the risk of unauthorized data access.
Original NVD Description
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.