CVE-2026-127216: Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure

Q: Who is exposed to this issue?

WordPress sites using Injection Guard versions before 1.4.0 are exposed if a logged-in administrator can be induced to open an attacker-controlled link. WooCommerce customer email hashes and password hashes are the data written by the vulnerable export action.

Q: Does an attacker need a WordPress account or administrator credentials?

No. The attacker can be unauthenticated, but exploitation requires social engineering a currently logged-in WordPress administrator to load a crafted link.

Q: How can I tell whether password hashes may already be exposed?

Check for the file wp-content/plugins/injection-guard/ab-hash.dat. If it exists and is reachable without authentication, it may contain exported WooCommerce customer email hashes and password hashes.

Q: What can be done if updating immediately is not possible?

Remove or restrict unauthenticated access to wp-content/plugins/injection-guard/ab-hash.dat and delete any existing exported file. Administrators should avoid opening untrusted links while logged in until the plugin is updated.

Published Nov 13, 2026

Updated

Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the igsettings admin page in templates/dashboard.php processes GET parameters without nonce verification. Attackers can exploit this to cause the plugin to write WooCommerce customer email hashes and password hashes to an unprotected file at wp-content/plugins/injection-guard/ab-hash.dat, which can then be downloaded without authentication to obtain customer password hashes for offline cracking.

Event History

Nov 13, 2026

CVE Published

via MITRE·08:41 PM

Data Sourced

via MITRE·08:41 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using Injection Guard versions before 1.4.0 are exposed if a logged-in administrator can be induced to open an attacker-controlled link. WooCommerce customer email hashes and password hashes are the data written by the vulnerable export action.

Does an attacker need a WordPress account or administrator credentials?

No. The attacker can be unauthenticated, but exploitation requires social engineering a currently logged-in WordPress administrator to load a crafted link.

How can I tell whether password hashes may already be exposed?

Check for the file wp-content/plugins/injection-guard/ab-hash.dat. If it exists and is reachable without authentication, it may contain exported WooCommerce customer email hashes and password hashes.

What can be done if updating immediately is not possible?

Remove or restrict unauthenticated access to wp-content/plugins/injection-guard/ab-hash.dat and delete any existing exported file. Administrators should avoid opening untrusted links while logged in until the plugin is updated.

CVE-2026-127216: Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does an attacker need a WordPress account or administrator credentials?

How can I tell whether password hashes may already be exposed?

What can be done if updating immediately is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does an attacker need a WordPress account or administrator credentials?

How can I tell whether password hashes may already be exposed?

What can be done if updating immediately is not possible?