wpengine vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20251
3. 20266

Newest CVEs

• CVE-2026-54239

  FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

  wpengine · faustjs

  High8.8
• CVE-2026-8382

  Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters

  wpengine · Advanced Custom Fields (ACF®)

  Medium5.3
• CVE-2026-4029

  Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export

  wpengine · Database Backup for WordPress

  High7.5
• CVE-2026-4030

  Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion

  wpengine · Database Backup for WordPress

  High8.1
• CVE-2026-4031

  Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception

  wpengine · Database Backup for WordPress

  High7.5
• CVE-2026-4812

  Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters

  wpengine · Advanced Custom Fields (ACF®)

  Medium5.3
• CVE-2025-11427

  WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery

  wpengine · WP Migrate Lite – Migration Made Easy

  Medium5.8
• CVE-2022-4974

  Freemius SDK <= 2.4.2 - Missing Authorization Checks

  dashlabsltd · YASR – Yet Another Star Rating Plugin for WordPress

  Medium6.3
• CVE-2023-6701

  Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field

  wpengine · Advanced Custom Fields (ACF®)

  Medium6.4
• CVE-2023-6933

  Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

  wpengine · Better Search Replace

  High8.8