CVE-2026-127216

MEDIUM 6.5

Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the ig_settings admin page in templates/dashboard.php processes GET parameters without nonce verification. Attackers can exploit this to cause the plugin to write WooCommerce customer email hashes and password hashes to an unprotected file at wp-content/plugins/injection-guard/ab-hash.dat, which can then be downloaded without authentication to obtain customer password hashes for offline cracking.

CWE	CWE-352
Vendor	fahad mahmood
Product	injection guard
Published	Nov 13, 2026
Last Updated	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for fahad mahmood injection guard

Be the first to know when new medium vulnerabilities affecting fahad mahmood injection guard are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Fahad Mahmood / Injection Guard

0 < 1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordpress.org: https://wordpress.org/plugins/injection-guard/#developers vulncheck.com: https://www.vulncheck.com/advisories/injection-guard-wordpress-plugin-csrf-password-hash-disclosure

Credits

🔍 buiih