Unauthenticated WP JAN 2025
Managed WP/Woo Security Report
Be informed about the latest Unauthenticated WP JAN 2025 - WP Security Circumvention, identified and reported publicly. It is a +2% INCREASE compared to previous month, as specifically going around existing security. Consider for your online safety, a managed WP/Woo security AUDIT, – OR – switching with a TOP10LIST alternative WP Security Plugin – OR – Hire us for your recurrent needs of managed WordPress Security and managed WooCommerce Security.
WHO needs managed WP security? EVERYBODY!
Today's reality needs a Web Application Firewall (WAF) plus an Intrusion Prevention System (IPS) to mitigate "gazillion" different threats in your WordPress. Get your Unauthenticated WP JAN 2025 Patch Management.
The following cases made headlines PUBLICLY just last month in the Unauthenticated WP JAN 2025 category:
| Accept Authorize.NET Payments Using Contact Form 7 | Unauthenticated Information Exposure |
| Active Products Tables for WooCommerce | Unauthenticated Arbitrary Shortcode Execution (BAC) from woot_get_smth |
| AIO Contact | Unauthenticated Plugin Settings Change (BAC) |
| AIO Contact | Unauthenticated Site-Wide Cross-Site Scripting (XSS) |
| AR For WordPress | Missing Authorization (BAC) to Unauthenticated Limited File Upload (BAC) |
| Authors List | Unauthenticated Arbitrary Shortcode Execution (BAC) from Update (BAC)_authors_list_ajax |
| Beautiful Taxonomy Filters | Unauthenticated SQL Injection (SQLi) |
| Collapsing Categories | Unauthenticated SQL Injection (SQLi) |
| Content No Cache | Unauthenticated Private Content Private Data Disclosure |
| Coupon Affiliates | Unauthenticated Arbitrary Shortcode Execution (BAC) and Cross-Site Scripting (XSS) |
| Download Manager | Improper Authorization (BAC) to Unauthenticated Download of Password Protected Files + Private Data |
| Download Manager | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| EventPrime | Unauthenticated Cross-Site Scripting (XSS) from Ticket Category and Ticket Type Name |
| FAT Services Booking | Unauthenticated SQL Injection (SQLi) |
| FluentForm | Unauthenticated Cross-Site Scripting (XSS) from Form Subject |
| Frontend Admin by DynamiApps | Unauthenticated SQL Injection (SQLi) |
| Grid Plus | Unauthenticated Arbitrary Shortcode Execution (BAC) from grid_plus_load_by_category |
| Jetpack | Unauthenticated DOM and Cross-Site Scripting (XSS) |
| KiviCare | Unauthenticated SQL Injection (SQLi) |
| kk Star Ratings | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| Last Viewed Posts by WPBeginner | Unauthenticated Private Data Information Exposure |
| MainWP Child | Missing Authorization (BAC) to Unauthenticated Privilege Escalation (BAC) |
| Memberful | Unauthenticated Content Restriction Bypass (BAC) to Private Data Information Exposure |
| Members | Unauthenticated Content Restriction Bypass (BAC) to Private Data Information Exposure |
| Ninja Forms | Unauthenticated Cross-Site Scripting (XSS) from Form Calculations |
| Page Restriction WordPress (WP) | Unauthenticated Content Restriction Bypass (BAC) to Private Data Information Exposure |
| Paid Member Subscriptions | Unauthenticated Content Restriction Bypass (BAC) to Private Data Information Exposure |
| PPWP – WordPress Password Protect Page | Unauthenticated Content Restriction Bypass (BAC) to Private Data Information Exposure |
| Print Science Designer | Unauthenticated PHP Object Injection |
| Pubnews Theme | Unauthenticated Arbitrary Plugin Installation (BAC) |
| Rate my Post – WP Rating System | Unauthenticated Voting On Scheduled Posts |
| Restrict | Unauthenticated Content Restriction Bypass (BAC) to Private Data Information Exposure |
| Revy | Unauthenticated Arbitrary File Upload (BAC) |
| Revy | Unauthenticated SQL Injection (SQLi) |
| Simple Link Directory | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| Simple Page Access Restriction | Unauthenticated Content Restriction Bypass (BAC) to Private Data Information Exposure |
| Simple Restrict | Unauthenticated Content Restriction Bypass (BAC) to Private Data Information Exposure |
| Soledad Theme | Unauthenticated Limited Local File Inclusion (LFi) |
| Swift Performance Lite | Unauthenticated Local PHP File Inclusion from 'ajaxify' |
| The Events Calendar | Unauthenticated Password Protected Event Private Data Disclosure |
| TI WooCommerce Wishlist | Missing Authorization (BAC) to Unauthenticated Plugin Setup Wizard Access |
| Traveler | Unauthenticated SQL Injection (SQLi) from order_id |
| Verowa Connect | Unauthenticated SQL Injection (SQLi) |
| VibeBP | Unauthenticated Privilege Escalation (BAC) |
| VibeBP | Unauthenticated SQL Injection (SQLi) |
| Woffice Theme | Unauthenticated Account Takeover (BAC) |
| WooCommerce | Unauthenticated Order Creation |
| WoodMart | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| WP Data Access | Unauthenticated SQL Injection (SQLi) |
| WP Hide Security Enhancer | Missing Authorization (BAC) to Unauthenticated Arbitrary File Contents Deletion (BAC) |
| WPLMS | Unauthenticated SQL Injection (SQLi) |
| WPLMS | Unauthenticated Arbitrary Directory Deletion (BAC) |
| WPLMS | Unauthenticated Arbitrary File Upload (BAC) |
| WPLMS | Unauthenticated Arbitrary User Token Generation |
| WPLMS | Unauthenticated Privilege Escalation (BAC) |
| WPMobile.App | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| WP Private Content Plus | Unauthenticated Content Restriction Bypass (BAC) to Private Data Information Exposure |
| WP SuperBackup | Unauthenticated Arbitrary File Upload (BAC) |
| WP SuperBackup | Unauthenticated Arbitrary File Upload (BAC) |
| WP SuperBackup | Unauthenticated Backup File Download (BAC) |
| Unauthenticated WordPress reported in 2023: | 235 |
| Unauthenticated WordPress reported in 2024: | 628 |
| Unauthenticated WordPress reported in 2025: | 60 |
WHO needs managed WP Maintenance? EVERYBODY!
Today’s reality requires daily clean-ups with database optimisations, weekly updates and upgrades for both free & premium modules, plus the occasional emergency changes when critical vulnerabilities are publicly disclosed without patches. Order Unauthenticated WP JAN 2025 Patch Management.
Security is not a single-task job
Need managed WP Security and got no clue where to start? Hire an expert. Pay a coffee per week, its cheaper than 1 hour for a freelancer.
