The Admin Safety Guard WordPress plugin is vulnerable to an unauthenticated information exposure flaw that allows attackers to harvest sensitive user account data.

The plugin fails to implement necessary capability checks on a REST API endpoint, permitting unauthenticated users to query and retrieve the complete list of registered system users.

The exposure of user data, including roles and two-factor authentication enrollment status, significantly increases the risk of targeted social engineering or credential-stuffing attacks. While the CVSS score is 7.5, the ability for an attacker to map the user base without authentication provides a roadmap for further system exploitation, potentially leading to unauthorized account access and a breach of user privacy.

Immediate Action: Update the Admin Safety Guard plugin to version 1.4.0 or later immediately to enforce required authentication for the affected REST API endpoints.

Proactive Monitoring: Review web server access logs for anomalous requests directed toward the plugin's REST API routes, specifically looking for high-frequency requests from non-authenticated IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the specific REST API endpoints associated with the plugin until the update is successfully applied.

Public Exploit Available: Unknown.

Given the ease with which an attacker can enumerate the user base of a WordPress site, this vulnerability poses a significant risk to site security and user confidentiality. Administrators must prioritize updating the plugin to version 1.4.0 as soon as possible to close this information disclosure vector. Failure to remediate allows malicious actors to perform reconnaissance that facilitates more complex, downstream attacks against the organization.