Skip to content
OpenAdvisories

Vendor

wpengine

17 known vulnerabilities.

Products

Advanced Custom Fields PRO 5 Advanced Custom Fields (ACF®) 3 Database Backup for WordPress 3 Better Search Replace 1 faustjs 1 Gutenberg Blocks – ACF Blocks Suite 1 Advanced Custom Fields 1 WP Migrate 1 WP Migrate Lite – Migration Made Easy 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.8
    CVE-2026-54239

    FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

    Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\dec…

    wpengine faustjs Web / CMS
  • High 8.1
    CVE-2026-4030

    Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion

    The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check com…

    wpengine Database Backup for WordPress Web / CMS
  • High 7.5
    CVE-2026-4029

    Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export

    The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possi…

    wpengine Database Backup for WordPress Web / CMS
  • High 7.5
    CVE-2026-4031

    Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception

    The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wp_db_temp_dir parameter, which controls where database backups a…

    wpengine Database Backup for WordPress Web / CMS
  • High 8.5
    CVE-2024-34761

    Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Arbitrary Function Execution vulnerability

    Vulnerability discovered by executing a planned security audit. Improper Control of Generation of Code ('Code Injection') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows Code Injection.This issue affects Advanced Custom Fields PRO: from n/a be…

    wpengine Advanced Custom Fields PRO
  • High 8.8
    CVE-2023-6933 Public exploit EPSS 68%

    Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

    The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain …

    wpengine Better Search Replace Web / CMS