CVE-2026-127216 · Package
NO FIX YET · SEE WHAT TO DO
The Injection Guard WordPress plugin before 1.4.0 has a cross-site request forgery flaw in its admin dashboard that lets an attacker trick a logged-in administrator into triggering a password hash export. The export is written to a publicly downloadable file, so an attacker can obtain WooCommerce customer password hashes and crack them offline.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Injection Guard WordPress plugin before 1.4.0, especially stores using WooCommerce where customer accounts exist. The attack needs a logged-in administrator to open a crafted link, and the exported hash file is then downloadable without authentication. Sites without the plugin or running 1.4.0 or later are not affected.
Not affected if plugin-not-installed, version-1.4.0-or-later
Who cares self-hosted, woocommerce, wordpress
1.4.0 are affected.wp-content/plugins/injection-guard/ab-hash.dat on the web server; if it exists and is reachable over HTTP, customer hashes may already be exposed.1.4.0 or later.Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the ig_settings admin page in templates/dashboard.php processes GET parameters without nonce verification. Attackers can exploit this to cause the plugin to write WooCommerce customer email hashes and password hashes to an unprotected file at wp-content/plugins/injection-guard/ab-hash.dat, which can then be downloaded without authentication to obtain customer password hashes for offline cracking.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.