Cross-Site Request Forgery in Injection Guard Plugin for WordPress

CVE-2026-127216

What is CVE-2026-127216?

The Injection Guard plugin for WordPress before version 1.4.0 is susceptible to a cross-site request forgery (CSRF) vulnerability. This flaw allows unauthenticated attackers to exploit the plugin by tricking a logged-in administrator into clicking a malicious link. Without proper nonce verification, the plugin's ig_settings admin page processes GET parameters inappropriately. As a result, an attacker can force the plugin to export WooCommerce customer email and password hashes to an unsecured file, which can be accessed and downloaded without authentication. This presents a significant risk as attackers can obtain customer password hashes for offline cracking, highlighting the urgent need for updates and strengthened security measures.

References