CVE-2026-25471
Received Received - Intake
Authentication Bypass in Themepaste Admin Safety Guard

Publication date: 2026-03-19

Last updated on: 2026-04-28

Assigner: Patchstack

Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard admin-safety-guard allows Password Recovery Exploitation.This issue affects Admin Safety Guard: from n/a through <= 1.2.6.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-19
Last Modified
2026-04-28
Generated
2026-06-16
AI Q&A
2026-03-19
EPSS Evaluated
2026-06-14
NVD
CVE-2026-25471
EUVD
EUVD-2026-13063
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack admin_safety_guard to 1.2.6 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-25471 is a Broken Authentication vulnerability in the WordPress Admin Safety Guard Plugin versions up to 1.2.6. It allows unauthenticated attackers to bypass authentication mechanisms by exploiting an alternate path or channel, enabling them to perform actions normally restricted to administrators.

This vulnerability falls under the OWASP Top 10 category A7: Identification and Authentication Failures, meaning it compromises the authentication process and can lead to unauthorized access.

Impact Analysis

This vulnerability can have severe impacts as it allows attackers to gain administrative access to the affected WordPress site without authentication.

  • Attackers can escalate privileges and take control of the website.
  • They may perform unauthorized actions such as modifying content, stealing sensitive data, or installing malicious code.
  • The vulnerability has a high CVSS score of 8.1, indicating a high risk of exploitation and significant potential damage.

No official patch is currently available, increasing the urgency to apply mitigations or updates once released.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The WordPress Admin Safety Guard Plugin versions up to 1.2.6 are affected by a high-priority Broken Authentication vulnerability (CVE-2026-25471) that allows unauthenticated attackers to gain administrative access.

No official patch is currently available for this vulnerability.

Patchstack has issued a mitigation rule that can block attacks exploiting this flaw until a safe and tested official patch is released.

Users are strongly advised to update the plugin immediately once a patch becomes available.

Alternatively, seek assistance from your hosting provider or web developer to apply the mitigation rule or other protective measures.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25471. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart