WPDeeply
Download free plugin

Security Research

Historical and current WordPress vulnerability disclosures.

54
Guides
All 103 Plugin Security 58 Security Research 54 Vulnerability Types 11 Hardening 10 Security News 7 Malware 5 WordPress Insights 4 RSS
PPWP Password Protect Pages <= 1.9.18 - Contributor+ PHP Object Injection CVE-2026-0551 affects PPWP Password Protect Pages up to 1.9.18. Contributor-level users can inject a PHP object through post_protection_roles; real-world impact depends on whether another plugin or theme exposes… Plugin Security 23 Aug 2026, 3 min Security Hardener <= 2.4.4 - Subscriber+ Privilege Escalation via REST Users Permission Callback CVE-2026-16149 is a high-severity Security Hardener flaw where user-enumeration protection can overwrite WordPress REST user endpoint capability checks, allowing Subscriber-level users to perform privileged user actions. Update to… Hardening 23 Aug 2026, 3 min Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router CVE-2026-19598 is a critical Pods authorization bypass that can let unauthenticated attackers reach administrator methods, overwrite user passwords, or obtain administrator privileges. Update to 3.3.9.1 or a backported… Plugin Security 22 Aug 2026, 3 min miniOrange SAML Single Sign On – Unauthenticated Authentication Bypass Across Seven Editions Two miniOrange SAML Single Sign On flaws can let unauthenticated attackers sign in as existing WordPress users, including administrators. Paid editions need manual version checks because the normal… Plugin Security 22 Aug 2026, 3 min WordPress Security Testing (2026 Update) Short answer: you can’t verify a WordPress security vendor’s claims by reading their marketing page — you verify them by checking what’s actually testable: their CVE disclosure history,… Security Research 9 Aug 2026, 14 min WordPress Importer — Arbitrary Post Creation The official WordPress Importer accepts a structured file and creates content from it. WPDeeply’s 2021 disclosure examined what happens when the file is not trustworthy. Security Research 11 Mar 2021, 3 min WordPress $wpdb->prepare(), Denial of Service, and Memory Limits The practical risk is not that every use of $wpdb->prepare() is dangerous. The risk is that database helper code can become a denial-of-service path when untrusted input creates… Security Research 2 Dec 2020, 2 min Abandoned Cart Lite for WooCommerce before 5.8.2 — SQL Injection Unsanitised cart parameters in Abandoned Cart Lite for WooCommerce exposed stored customer data to unauthenticated extraction. Fixed in 5.8.3. Security Research 5 Nov 2020, 3 min Loginizer before 1.6.4 — Unauthenticated SQL Injection An unauthenticated SQL injection in Loginizer’s brute-force protection, reachable from any WordPress login form. Fixed in 1.6.4 — and pushed to over a million sites by a rare… Security Research 17 Oct 2020, 4 min Ninja Forms before 3.4.27.1 — Simple CSRF to RCE A missing request-origin check in Ninja Forms let one crafted link, clicked by a logged-in administrator, escalate into code execution. Fixed in 3.4.27.1. Security Research 8 Oct 2020, 4 min