Skip to content
OpenAdvisories

Vendor

wpengine

17 known vulnerabilities.

wpengine at a glance

Last 12 months
7
Critical · all time
2
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 1 vulnerability May 2026: 4 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202610
Aug 202600
Jul 202600
Jun 202600
May 202640
Apr 202610
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202510
Oct 202500
Sep 202500
Aug 202510
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202410

Products

Advanced Custom Fields PRO 5 Advanced Custom Fields (ACF®) 3 Database Backup for WordPress 3 Better Search Replace 1 faustjs 1 Gutenberg Blocks – ACF Blocks Suite 1 Advanced Custom Fields 1 WP Migrate 1 WP Migrate Lite – Migration Made Easy 1
All Critical High Medium Low Exploited only Public exploit

17 results · Feed

  • High 8.8
    CVE-2026-54239

    FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

    Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\dec…

    wpengine faustjs Web / CMS
  • Medium 5.3
    CVE-2026-8382

    Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters

    The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f…

    wpengine Advanced Custom Fields (ACF®) Web / CMS
  • High 8.1
    CVE-2026-4030

    Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion

    The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check com…

    wpengine Database Backup for WordPress Web / CMS
  • High 7.5
    CVE-2026-4029

    Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export

    The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possi…

    wpengine Database Backup for WordPress Web / CMS
  • High 7.5
    CVE-2026-4031

    Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception

    The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wp_db_temp_dir parameter, which controls where database backups a…

    wpengine Database Backup for WordPress Web / CMS
  • Medium 5.3
    CVE-2026-4812

    Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters

    The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that over…

    wpengine Advanced Custom Fields (ACF®) Web / CMS
  • Medium 5.8
    CVE-2025-11427

    WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery

    The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to ma…

    wpengine WP Migrate Lite – Migration Made Easy Web / CMS
  • Low 3.4
    CVE-2025-54940

    An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerabili…

    wpengine Advanced Custom Fields Web / CMS
  • Medium 4.3
    CVE-2024-37251

    WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPENGINE, INC. Advanced Custom Fields PRO.This issue affects Advanced Custom Fields PRO: from n/a before 6.3.2.

    wpengine Advanced Custom Fields PRO
  • Medium 5.4
    CVE-2024-37250

    WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Subscriber+ Broken Access Control vulnerability

    Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.

    wpengine Advanced Custom Fields PRO
  • Medium 4.3
    CVE-2024-37249

    WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Contributor+ Broken Access Control vulnerability

    Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.

    wpengine Advanced Custom Fields PRO
  • Medium 6.3
    CVE-2022-4974

    Freemius SDK <= 2.4.2 - Missing Authorization Checks

    The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_d…

    bPlugins saadiqbal Premmerce nicheaddons Web / CMS
  • Critical 9.9
    CVE-2024-34762

    Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability

    Vulnerability discovered by executing a planned security audit. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced…

    wpengine Advanced Custom Fields PRO
  • High 8.5
    CVE-2024-34761

    Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Arbitrary Function Execution vulnerability

    Vulnerability discovered by executing a planned security audit. Improper Control of Generation of Code ('Code Injection') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows Code Injection.This issue affects Advanced Custom Fields PRO: from n/a be…

    wpengine Advanced Custom Fields PRO
  • Critical 10.0
    CVE-2024-30225

    WordPress WP Migrate plugin <= 2.6.10 - Unauthenticated PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in WPENGINE, INC. WP Migrate.This issue affects WP Migrate: from n/a through 2.6.10.

    wpengine WP Migrate
  • Medium 6.4
    CVE-2023-6701

    Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field

    The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authe…

    wpengine Delicious Brains Advanced Custom Fields (ACF®) Advanced Custom Fields Pro Web / CMS
  • High 8.8
    CVE-2023-6933 Public exploit EPSS 68%

    Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

    The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain …

    wpengine Better Search Replace Web / CMS