{"id":"CVE-2026-127216","kind":"vulnerability","aliases":["CVE-2026-127216"],"related":[],"title":"WordPress Injection Guard plugin: CSRF leaks customer password hashes","description":"Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the ig_settings admin page in templates/dashboard.php processes GET parameters without nonce verification. Attackers can exploit this to cause the plugin to write WooCommerce customer email hashes and password hashes to an unprotected file at wp-content/plugins/injection-guard/ab-hash.dat, which can then be downloaded without authentication to obtain customer password hashes for offline cracking.","summary":"The Injection Guard WordPress plugin before 1.4.0 has a cross-site request forgery flaw in its admin dashboard that lets an attacker trick a logged-in administrator into triggering a password hash export. The export is written to a publicly downloadable file, so an attacker can obtain WooCommerce customer password hashes and crack them offline.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-1.4.0-or-later"],"how_to_check":"- Check the installed version of the Injection Guard plugin in the WordPress admin plugins list; versions below `1.4.0` are affected.\n- Look for the file `wp-content/plugins/injection-guard/ab-hash.dat` on the web server; if it exists and is reachable over HTTP, customer hashes may already be exposed.","fix":"- Injection Guard plugin: upgrade to `1.4.0` or later.","status":"open","published_at":"2026-11-13T21:17:43+00:00","first_seen_at":"2026-11-13T21:33:40+00:00","triaged_at":"2026-11-13T21:33:47+00:00","updated_at":"2026-11-13T21:33:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T21:33:47Z","model":"claude-haiku-5-5","output":{"fix":"- Injection Guard plugin: upgrade to `1.4.0` or later.","reach":"internet","title":"WordPress Injection Guard plugin: CSRF leaks customer password hashes","impact":"high","summary":"The Injection Guard WordPress plugin before 1.4.0 has a cross-site request forgery flaw in its admin dashboard that lets an attacker trick a logged-in administrator into triggering a password hash export. The export is written to a publicly downloadable file, so an attacker can obtain WooCommerce customer password hashes and crack them offline.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Customer password hashes become downloadable for offline cracking","analyst_note":"","how_to_check":"- Check the installed version of the Injection Guard plugin in the WordPress admin plugins list; versions below `1.4.0` are affected.\n- Look for the file `wp-content/plugins/injection-guard/ab-hash.dat` on the web server; if it exists and is reachable over HTTP, customer hashes may already be exposed.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-1.4.0-or-later"],"who_is_affected":"Sites running the Injection Guard WordPress plugin before 1.4.0, especially stores using WooCommerce where customer accounts exist. The attack needs a logged-in administrator to open a crafted link, and the exported hash file is then downloadable without authentication. Sites without the plugin or running 1.4.0 or later are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000786,"input_tokens":4687,"output_tokens":635,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127216':12A,15A '-2026':11A,14A '/plugins/injection-guard/ab-hash.dat':154C '1.4.0':28B,85C 'admin':39B,119C 'administr':50B,109C 'allow':95C 'attack':44B,68B,97C,129C 'authent':161C 'caus':134C 'contain':86C 'content':153C 'crack':76B,169C 'craft':113C 'cross':32B,89C 'cross-sit':31B,88C 'csrf':5A 'custom':7A,72B,140C,164C 'cve':10A,13A 'dashboard':40B 'download':64B,159C 'email':141C 'exploit':131C 'export':56B,58B,102C 'file':65B,149C 'flaw':36B 'forgeri':35B,92C 'get':124C 'guard':3A,24B,80C 'hash':9A,55B,74B,101C,142C,145C,166C 'host':19B 'ig':117C 'inject':2A,23B,79C 'leak':6A 'let':42B 'link':114C 'load':111C 'log':48B,107C 'logged-in':47B,106C 'nonc':127C 'obtain':70B,163C 'offlin':78B,168C 'packag':16B 'page':120C 'paramet':125C 'password':8A,54B,73B,100C,144C,165C 'plugin':4A,26B,81C,136C 'process':123C 'public':63B 'request':34B,91C 'self':18B 'self-host':17B 'set':118C 'sinc':115C 'site':33B,90C 'templates/dashboard.php':122C 'trick':45B,104C 'trigger':52B,99C 'unauthent':96C 'unprotect':148C 'verif':128C 'vulner':93C 'without':126C,160C 'woocommerc':20B,71B,139C 'wordpress':1A,21B,25B,83C 'wp':152C 'wp-content':151C 'write':138C 'written':60B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Injection Guard WordPress plugin before 1.4.0, especially stores using WooCommerce where customer accounts exist. The attack needs a logged-in administrator to open a crafted link, and the exported hash file is then downloadable without authentication. Sites without the plugin or running 1.4.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-127216':12A,15A '-2026':11A,14A 'csrf':5A 'custom':7A 'cve':10A,13A 'guard':3A 'hash':9A 'inject':2A 'leak':6A 'password':8A 'plugin':4A 'wordpress':1A","search_b":"'1.4.0':28B 'admin':39B 'administr':50B 'attack':44B,68B 'crack':76B 'cross':32B 'cross-sit':31B 'custom':72B 'dashboard':40B 'download':64B 'export':56B,58B 'file':65B 'flaw':36B 'forgeri':35B 'guard':24B 'hash':55B,74B 'host':19B 'inject':23B 'let':42B 'log':48B 'logged-in':47B 'obtain':70B 'offlin':78B 'packag':16B 'password':54B,73B 'plugin':26B 'public':63B 'request':34B 'self':18B 'self-host':17B 'site':33B 'trick':45B 'trigger':52B 'woocommerc':20B,71B 'wordpress':21B,25B 'written':60B","search_c":"'/plugins/injection-guard/ab-hash.dat':154C '1.4.0':85C 'admin':119C 'administr':109C 'allow':95C 'attack':97C,129C 'authent':161C 'caus':134C 'contain':86C 'content':153C 'crack':169C 'craft':113C 'cross':89C 'cross-sit':88C 'custom':140C,164C 'download':159C 'email':141C 'exploit':131C 'export':102C 'file':149C 'forgeri':92C 'get':124C 'guard':80C 'hash':101C,142C,145C,166C 'ig':117C 'inject':79C 'link':114C 'load':111C 'log':107C 'logged-in':106C 'nonc':127C 'obtain':163C 'offlin':168C 'page':120C 'paramet':125C 'password':100C,144C,165C 'plugin':81C,136C 'process':123C 'request':91C 'set':118C 'sinc':115C 'site':90C 'templates/dashboard.php':122C 'trick':104C 'trigger':99C 'unauthent':96C 'unprotect':148C 'verif':128C 'vulner':93C 'without':126C,160C 'woocommerc':139C 'wordpress':83C 'wp':152C 'wp-content':151C 'write':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T21:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127216","severity":null,"published_at":"2026-11-13T21:17:43+00:00","modified_at":"2026-11-13T21:17:43+00:00","first_seen_at":"2026-11-13T21:33:40+00:00","fetched_at":"2026-11-13T21:33:40+00:00","note":null}],"documents":[{"id":150288,"url":"https://www.vulncheck.com/advisories/injection-guard-wordpress-plugin-csrf-password-hash-disclosure","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}