Last week, there were 246 vulnerabilities disclosed in 174 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 121 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- InfusedWoo Pro <= 5.1.18 – Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure
- WPeMatico RSS Feed Fetcher <= 2.8.24 – Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
- WPMU DEV Dashboard <= 5.0.1 – Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
- WPLP Cookie Consent <= 4.4.1 – Unauthenticated Arbitrary File Upload via ‘upload-logo’ REST Endpoint
- WAF-RULE-953 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-955 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 234 |
| Unpatched | 12 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 2 |
| Medium Severity | 153 |
| High Severity | 73 |
| Critical Severity | 18 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 57 |
| Missing Authorization | 46 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 22 |
| Authorization Bypass Through User-Controlled Key | 16 |
| Exposure of Sensitive Information to an Unauthorized Actor | 14 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 14 |
| Improper Privilege Management | 13 |
| Improper Control of Generation of Code ('Code Injection') | 10 |
| Deserialization of Untrusted Data | 8 |
| Unrestricted Upload of File with Dangerous Type | 8 |
| Cross-Site Request Forgery (CSRF) | 7 |
| Client-Side Enforcement of Server-Side Security | 5 |
| Server-Side Request Forgery (SSRF) | 5 |
| Improper Authentication | 4 |
| Authentication Bypass by Alternate Name | 2 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Missing Authentication for Critical Function | 2 |
| Embedded Malicious Code | 1 |
| Generation of Predictable Numbers or Identifiers | 1 |
| Guessable CAPTCHA | 1 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 1 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 1 |
| Improper Verification of Cryptographic Signature | 1 |
| Insufficient Verification of Data Authenticity | 1 |
| Uncontrolled Resource Consumption | 1 |
| URL Redirection to Untrusted Site ('Open Redirect') | 1 |
| Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | 1 |
| Weak Password Recovery Mechanism for Forgotten Password | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 17 | |
| 14 | |
| 12 | |
| 12 | |
| 9 | |
| 9 | |
| 7 | |
| 7 | |
| 6 | |
| 6 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 12 Step Meeting List | 12-step-meeting-list |
| ACPT (Premium) | advanced-custom-post-type |
| Advanced Custom Fields: Extended | acf-extended |
| Affiliate Program Suite — SliceWP Affiliates | slicewp |
| AI Engine – The Chatbot, AI Framework & MCP for WordPress | ai-engine |
| All-in-One WP Migration and Backup | all-in-one-wp-migration |
| All-in-One WP Migration Unlimited Extension | all-in-one-wp-migration-unlimited-extension |
| Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates | animation-addons-for-elementor |
| Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress | bookingpress-appointment-booking |
| Avada (Fusion) Builder | fusion-builder |
| Beautiful taxonomy filters | beautiful-taxonomy-filters |
| BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP | betterlinks |
| BlogVault Backup & Staging | blogvault-real-time-backup |
| Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment | booking-and-rental-manager-for-woocommerce |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| Booking Package | booking-package |
| Breeze Cache | breeze |
| Catfolders Document Gallery Pro | catfolders-document-gallery-pro |
| Classified Listing - Mobile Number Verification | rtcl-verification |
| CM Map Locations – Visualize and share your locations in a few clicks | cm-map-locations |
| CMP – Coming Soon & Maintenance Plugin by NiteoThemes | cmp-coming-soon-maintenance |
| Content Mask | content-mask |
| Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates | cozy-addons |
| CP Media Player – Audio Player and Video Player | audio-and-video-player |
| Custom User Registration Fields for WooCommerce | user-registration-plugin-for-woocommerce |
| Customer Reviews for WooCommerce | customer-reviews-woocommerce |
| Defender Security – Malware Scanner, Login Security & Firewall | defender-security |
| Directorist: AI-Powered Business Directory, Listings & Classified Ads | directorist |
| Ditty – Responsive News Tickers, Sliders, and Lists | ditty-news-ticker |
| Document Embedder – let visitors read files without downloading | document-emberdder |
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | dokan-lite |
| Drag and Drop Multiple File Upload for Contact Form 7 | drag-and-drop-multiple-file-upload-contact-form-7 |
| Duplicate Post | copy-delete-posts |
| eCommerce Product Catalog | ecommerce-product-catalog |
| ElementsKit Pro | elementskit |
| Email Essentials | email-essentials |
| Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | email-subscribers |
| Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More | envira-gallery-lite |
| ePayco plugin for WooCommerce | epayco-gateway |
| ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | erp |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | mage-eventpress |
| Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| Events Manager – Calendar, Bookings, Tickets, and more! | events-manager |
| Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | everest-forms |
| FiboSearch – Ajax Search for WooCommerce | ajax-search-for-woocommerce |
| Finale Lite – Sales Countdown Timer & Discount for WooCommerce | finale-woocommerce-sales-countdown-timer-discount |
| Fluent Boards Pro | fluent-boards-pro |
| Fluent Booking Pro | fluent-booking-pro |
| Fluent Forms Pro Add On Pack | fluentformpro |
| Fluent Player Pro | fluent-player-pro |
| Fluent Support Pro | fluent-support-pro |
| FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | fluent-cart |
| FluentCRM PRO | fluentcampaign-pro |
| FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | fluentcrm-pro |
| Formidable Charts | formidable-charts |
| Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More | formidable |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Frontend Admin by DynamiApps | acf-frontend-form-element |
| FundEngine – Donation and Crowdfunding Platform | wp-fundraising-donation |
| Geo Controller | cf-geoplugin |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| GeotargetingWP | geotargetingwp |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| Greenshift – animation and page builder blocks | greenshift-animation-and-page-builder-blocks |
| Gutenverse – WordPress Blocks, Page Builder & Site Editor | gutenverse |
| Hash Form – Drag & Drop Form Builder | hash-form |
| HEL Online Classroom: AI-powered Online Classrooms | hel-online-classroom |
| InfusedWoo Pro | infusedwooPRO |
| JetBackup – Backup, Restore & Migrate | backup |
| JetEngine | jet-engine |
| Kadence Shop Kit | kadence-shop-kit |
| Kali Forms — Contact Form & Drag-and-Drop Builder | kali-forms |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| KiviCare – Clinic & Patient Management System (EHR) | kivicare-clinic-management-system |
| LeadConnector | leadconnector |
| LearnPress – Sepay Payment | learnpress-sepay-payment |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
Like Button Rating  LikeBtn |
likebtn-like-button |
| Link Whisper Free | link-whisper |
| LiteSpeed Cache | litespeed-cache |
| LitExtension – Automated Store Migration & Import | litextension-data-migration-to-woocommerce |
| Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid | magazine-blocks |
| MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall | malcare-security |
| ManageWP Worker | worker |
| Mang Board WP | mangboard |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| Media Library Assistant | media-library-assistant |
| Media Sweep – WordPress Media Cleaner | media-sweep |
| MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | metform |
| miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon | miniorange-login-openid |
| Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce | mobile-app-for-woocommerce |
| MStore API – Create Native Android & iOS Apps On The Cloud | mstore-api |
| Music Player for WooCommerce | music-player-for-woocommerce |
| MW WP Form | mw-wp-form |
| My Agile Privacy® – CMP, Cookie Consent & Privacy Tools | myagileprivacy |
| MyHome Core | myhome-core |
| NewPath WildApricotPress Add-on – Member Directory | newpath-wildapricotpress-add-on-member-directory |
| Newsletters | newsletters-lite |
| Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist | woocommerce-product-stock-alert |
| One User Avatar | User Profile Picture | one-user-avatar |
| Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | optimole-wp |
| Order Tip for WooCommerce | order-tip-woo |
| OwnerRez | ownerrez |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | wp-user-avatar |
| Passster – Password Protect Pages and Content | content-protector |
| Pods – Custom Content Types and Fields | pods |
| Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | mycred |
| Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | post-smtp |
| PPWP – Password Protect Pages | password-protect-page |
| Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages | wplegalpages |
| Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | wedevs-project-manager |
| Push Notification for Post and BuddyPress | push-notification-for-post-and-buddypress |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | seo-by-rank-math |
| Realtyna Organic IDX plugin + WPL Real Estate | real-estate-listing-realtyna-wpl |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress | computer-repair-shop |
| RestrictMate – Restrict Page, Post and any Content ( Content Restriction and Membership Plugin) | restrictmate |
| Return Refund and Exchange For WooCommerce | woo-refund-and-exchange-lite |
| Reviews and Rating – Google Reviews | g-business-reviews-rating |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| SAML Single Sign On – SSO Login | miniorange-saml-20-single-sign-on |
| Security Optimizer – The All-In-One Protection Plugin | sg-security |
| Shared Files Pro | shared-files-pro |
| Shared Files – File Upload & Download Manager | shared-files |
| ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets | shopengine |
| SigmaForms Pro – AI Generated Forms | sigmaforms-pro |
| Simple Newsletter Plugin – Noptin | newsletter-optin-box |
| Simple Payment | simple-payment |
| Slider Hero with Video Background, Animation | slider-hero |
| Smart Marketing SMS and Newsletters Forms | smart-marketing-for-wp |
| Smart Slider 3 | smart-slider-3 |
| SmartAIPress | smartaipress |
| SmilePass Selfie Login | selfie-login |
| SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery | sms-alert |
| Smush – Image Optimization, Compression, Lazy Load, WebP & CDN | wp-smushit |
| SOGO Add Script to Individual Pages Header Footer | oh-add-script-header-footer |
| StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce | storegrowth-sales-booster |
| Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions | wp-full-stripe-free |
| Suggestion Engine for WooCommerce | woo-suggestion-engine |
| Super Store Finder | superstorefinder-wp |
| SureFeedback Client Site | projecthuddle-child-site |
| tagDiv Composer | td-composer |
| Tailored Tools | tailored-tools |
| Tamara Checkout | tamara-checkout |
| The WP Remote WordPress Plugin | wpremote |
| Throws SPAM Away | throws-spam-away |
| Tickera – Sell Tickets & Manage Events | tickera-event-ticketing-system |
| TranslatePress – Translate Multilingual sites with AI Translation | translatepress-multilingual |
| Tutor LMS – eLearning and online course solution | tutor |
| Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | ultimate-member |
| UpdraftPlus: WP Backup & Migration Plugin | updraftplus |
| User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | wp-user-frontend |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | profile-builder |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration |
| Visitor Traffic Real Time Statistics pro | visitors-traffic-real-time-statistics-pro |
| WCFM Marketplace – Multivendor Marketplace for WooCommerce | wc-multivendor-marketplace |
| WooCommerce Lottery | woocommerce-lottery |
| Workeera – AI Job Board with Applicant Tracking System (ATS) | workeera-remote-tech-job-board |
| WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses | wp-courses |
| WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | wp-data-access |
| WP Fastest Cache – WordPress Cache Plugin | wp-fastest-cache |
| WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | wp-job-portal |
| WP OAuth Server ( Login with WordPress ) | miniorange-oauth-20-server |
| WP Rocket | wp-rocket |
| WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import | wp-ultimate-csv-importer |
| WP w3all phpBB | wp-w3all-phpbb-integration |
| WPBulky – WordPress Bulk Edit Post Types | wpbulky-wp-bulk-edit-post-types |
| WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | wp-cafe |
| wpForo Forum | wpforo |
| WPMU DEV Dashboard | wpmudev-updates |
| WPvivid — Backup, Migration & Staging | wpvivid-backuprestore |
| 爱采集数据采集和发布插件 | icollect |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Avada | Website Builder For WordPress & WooCommerce | Avada |
| Betheme | betheme |
| CozyStay - Hotel Booking WordPress Theme | cozystay |
| Newspapers X | newspapers-x |
| Uncode | uncode |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
ACPT (Premium) [advanced-custom-post-type]
Researcher
Affected Software
Avada (Fusion) Builder [fusion-builder]
Researchers