CVE-2026-127216 Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure

Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the igsettings admin page in templates/dashboard.php...

CVE-2026-127216

The Injection Guard plugin for WordPress (versions before 1.4.0 ) is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is that the ig_settings admin page in templates/dashboard.php processes GET parameters without performing nonce verification . This allows an unauth...