WP BAC MAY 2025
WP Broken Access Control
Managed WordPress Security Report
Be informed about the latest WP Broken Access Control, identified and reported publicly. WP BAC MAY 2025 is a +99% INCREASE compared to previous month. Consider for your online safety, a managed WP/Woo security AUDIT, – OR – switching with a TOP10LIST alternative WP Security Plugin – OR – Hire us for your recurrent needs of managed WordPress Security and managed WooCommerce Security.
WHO needs managed WP security? EVERYBODY!
Today's reality needs a Web Application Firewall (WAF) plus an Intrusion Prevention System (IPS) to mitigate "gazillion" different threats in your WordPress. Get your WP BAC MAY 2025: WP Broken Access Control Patch Management.
The following cases made headlines PUBLICLY just last month in the WP Broken Access Control category:
| 1-Click Backup & Restore Database | Broken Access Control (BAC) |
| 6Storage Rentals | Broken Access Control (BAC) |
| Accessibility Suite | Arbitrary File Upload (BAC) |
| ACME Divi Modules | Broken Access Control (BAC) |
| ActiveDEMAND | Broken Access Control (BAC) |
| Add Product Frontend for WooCommerce | Arbitrary Content Deletion (BAC) |
| AdMail – Multilingual Back in-Stock Notifier for WooCommerce | Broken Access Control (BAC) |
| Admin and Site Enhancements (ASE) | Password Protection Bypass (BAC) |
| Administrator Z | Privilege Escalation (BAC) |
| Administrator Z | Directory Traversal (BAC) |
| Advanced Accordion Gutenberg Block | Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| Advanced Dynamic Pricing for WooCommerce | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| Advanced Google Maps | Broken Access Control (BAC) |
| Advanced Linked Variations for Woocommerce | Broken Access Control (BAC) |
| Aeropage Sync for Airtable | Arbitrary File Upload (BAC) |
| Aeropage Sync for Airtable | Missing Authorization (BAC) to Arbitrary Post Deletion |
| Age Gate | Broken Access Control (BAC) |
| Agency Toolkit | Broken Access Control (BAC) |
| AI Content Pipelines | Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| AI Hub Theme | Arbitrary File Upload (BAC) |
| Ai Image Alt Text Generator for WP | Broken Access Control (BAC) |
| AI Text to Speech | Broken Access Control (BAC) |
| AnalyticsWP | Broken Access Control (BAC) |
| Anant Addons for Elementor | Cross-Site Request Forgery (CSRF) and Arbitrary Plugin Installation (BAC) |
| Anps Theme | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| AnyTrack Affiliate Link Manager | Broken Access Control (BAC) |
| Apimo Connector | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| Append Content | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| Appointify | Arbitrary File Upload (BAC) |
| Appointment Booking Calendar | Broken Access Control (BAC) |
| Appointy Appointment Scheduler | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| Apptivo Business Site CRM | Arbitrary Content Deletion (BAC) |
| Asgaros Forum | File Upload (BAC) Numbers Bypass (BAC) |
| Astra Security Suite | Broken Access Control (BAC) |
| AtomChat | Broken Access Control (BAC) |
| Auto Post After Image Upload | Broken Access Control (BAC) |
| Automatic Featured Images from Videos | Broken Access Control (BAC) |
| Avatar | Arbitrary File Deletion (BAC) |
| azurecurve Shortcodes in Comments | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| Barcode Generator for WooCommerce | Arbitrary Content Deletion (BAC) |
| Barcode Generator for WooCommerce | Arbitrary Content Deletion (BAC) |
| Barcode Generator for WooCommerce | Settings Change (BAC) |
| Basic Interactive World Map | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| BERTHA AI | Arbitrary Content Deletion (BAC) |
| Bit Form – Contact Form Plugin | Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| Bloggie Theme | Arbitrary File Upload (BAC) |
| BM Content Builder | Missing Authorization (BAC) to Arbitrary Options Update (BAC) |
| Booking and Rental Manager | Broken Access Control (BAC) |
| Booking and Rental Manager | Broken Access Control (BAC) |
| Booking Calendar and Notification | Broken Authentication (BAC) |
| Bookingor | Broken Access Control (BAC) |
| Booster for WooCommerce | Unauthenticated Arbitrary File Upload (BAC) |
| Breaking News WP | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| Bring Fraktguiden for WooCommerce | Broken Access Control (BAC) |
| Brizy Pro | Broken Access Control (BAC) |
| Broadstreet | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| Buddypress Force Password Change | Account Takeover (BAC) from Password Update (BAC) |
| Buddypress Humanity | Cross-Site Request Forgery (CSRF) and Privilege Escalation (BAC) |
| Bulk Theme | Broken Access Control (BAC) |
| Bulk Theme Assign Linked Products For WooCommerce | Broken Access Control (BAC) |
| Bulk Theme Fields Editor | Broken Access Control (BAC) |
| Car Park Booking System for WordPress | Broken Access Control (BAC) |
| CartBoss | Broken Access Control (BAC) |
| Category Icon | Arbitrary File Download (BAC) |
| Celestial Aura Theme | Arbitrary File Upload (BAC) |
| CF7 Spreadsheets | Settings Change (BAC) |
| Chat by Chatwee | Broken Access Control (BAC) |
| Checkout Mestres WP | Privilege Escalation (BAC) |
| Clients | Broken Access Control (BAC) |
| Cloak Front End Email | Broken Access Control (BAC) |
| Clockinator Lite | Broken Access Control (BAC) |
| CM Registration and Invitation Codes | Broken Access Control (BAC) |
| Configurator Theme Core | Privilege Escalation (BAC) |
| Connector to CiviCRM with CiviMcRestFace | Broken Access Control (BAC) |
| ContentMX Content Publisher | Broken Access Control (BAC) |
| Course Booking System | Broken Access Control (BAC) |
| Crossword Compiler Puzzles | Arbitrary File Upload (BAC) |
| Cryptocurrency Widgets Pack | Broken Access Control (BAC) |
| Cue | Broken Access Control (BAC) |
| Custom Login and Registration | Broken Access Control (BAC) |
| Customify Theme | Broken Access Control (BAC) |
| Customize Login Page | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| Dashi | Broken Access Control (BAC) |
| Database Toolset | Arbitrary File Deletion (BAC) |
| Demo Awesome | Missing Authorization (BAC) to Plugin Activation |
| DethemeKit For Elementor | Broken Access Control (BAC) |
| Display product variations dropdown on shop page | Broken Access Control (BAC) |
| Docxpresso | Arbitrary File Download (BAC) |
| Doppler Forms | Broken Access Control (BAC) |
| Download Alt Text AI | Broken Access Control (BAC) |
| Download Manager | Arbitrary File Deletion (BAC) |
| Download Manager | Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| Dynamic Post | Settings Change (BAC) |
| Easy WP Optimizer | Broken Access Control (BAC) |
| Easy!Appointments | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| eaSYNC | Broken Access Control (BAC) |
| Eazy Plugin Manager | Broken Access Control (BAC) |
| EazyDocs | Broken Access Control (BAC) |
| Eduma Theme | Broken Access Control (BAC) |
| ELEX WooCommerce Request a Quote | Broken Access Control (BAC) |
| Elfsight Testimonials Slider | Broken Access Control (BAC) |
| Elfsight Testimonials Slider | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| Email Notifications for Updates | Privilege Escalation (BAC) |
| Embedder | Arbitrary Options Update (BAC) |
| Essential Breadcrumbs | Cross-Site Request Forgery (CSRF) and Privilege Escalation (BAC) |
| Everest Forms | Arbitrary Shortcode Execution (BAC) |
| Eximius Theme | Arbitrary File Upload (BAC) |
| Export All Post Meta | Broken Access Control (BAC) |
| Flo Forms | Broken Access Control (BAC) |
| Flynax Bridge | Unauthenticated Privilege Escalation (BAC) from Account Takeover (BAC) |
| Flynax Bridge | Unauthenticated Privilege Escalation (BAC) from Password Update (BAC) |
| Fonto | Arbitrary File Download (BAC) |
| Form Builder | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| FPW Category Thumbnails | Broken Access Control (BAC) |
| Free Woocommerce Product Table View | Arbitrary Content Deletion (BAC) |
| Free Woocommerce Product Table View | Broken Access Control (BAC) |
| Front End Users | Unauthenticated Arbitrary File Upload (BAC) |
| Frontend Login and Registration Blocks | Privilege Escalation (BAC) from Password Reset |
| FS Poster | Site Wide Broken Access Control (BAC) |
| GB Gallery Slideshow | Broken Access Control (BAC) |
| GDPR Cookie Notice | Broken Access Control (BAC) |
| GetBookingsWP | Broken Access Control (BAC) |
| Gift Cards for WooCommerce | Broken Access Control (BAC) |
| Google SEO Pressor Snippet | Broken Access Control (BAC) |
| Grand Restaurant WordPress Theme | Broken Access Control (BAC) |
| Grand Restaurant WordPress Theme | Path Traversal (BAC) to PHP Object Injection |
| Greenshift | Arbitrary File Upload (BAC) |
| Hive Support | Broken Access Control (BAC) |
| Hive Support | Broken Access Control (BAC) |
| Hospital Management System | Arbitrary File Upload (BAC) |
| Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue | Broken Access Control (BAC) |
| Houzez Property Feed | Arbitrary File Download (BAC) |
| I Draw | Arbitrary File Upload (BAC) |
| Include URL | Arbitrary File Download (BAC) |
| include-file | Arbitrary File Download (BAC) |
| Industrial Lite Theme | Broken Access Control (BAC) |
| Insert Headers And Footers | Cross-Site Request Forgery (CSRF) and Arbitrary Options Update (BAC) |
| Insert Headers and Footers Code – HT Script | Missing Authorization (BAC) to Limited Options Update (BAC) |
| Insert or Embed Articulate Content into WordPress | Arbitrary File Upload (BAC) |
| Integração entre Eduzz e Woocommerce | Missing Authorization (BAC) to Privilege Escalation (BAC) |
| Internal Link Optimiser | Settings Change (BAC) |
| JetBlocks For Elementor | Broken Access Control (BAC) |
| JetBlog | Broken Access Control (BAC) |
| JetBlog | Broken Access Control (BAC) |
| JetElements For Elementor | Broken Access Control (BAC) |
| JetMenu | Broken Access Control (BAC) |
| JetMenu | Broken Access Control (BAC) |
| JetPopup | Broken Access Control (BAC) |
| JetPopup | Broken Access Control (BAC) |
| JetTricks | Broken Access Control (BAC) |
| JetTricks | Broken Access Control (BAC) |
| JetWooBuilder | Broken Access Control (BAC) |
| JNews Theme | Broken Access Control (BAC) |
| Job Board Manager | Broken Access Control (BAC) |
| JobBoard Job listing | Broken Access Control (BAC) |
| JobSearch | Authentication Bypass (BAC) from Social Logins |
| JS Job Manager | Arbitrary File Upload (BAC) |
| JS Job Manager | Broken Access Control (BAC) |
| Kadence WooCommerce Email Designer | Arbitrary File Upload (BAC) |
| Kleo Theme | Broken Access Control (BAC) |
| Lafka Plugin | Missing Authorization (BAC) to Theme Option Update |
| Lana Downloads Manager | Arbitrary File Download (BAC) from Path Traversal (BAC) |
| Linet ERP-Woocommerce Integration | Arbitrary File Read (BAC)/Deletion |
| Live Forms | Broken Access Control (BAC) |
| Live Forms | Broken Access Control (BAC) |
| Local Magic | Broken Access Control (BAC) |
| Lottie Player block - Implement Lottie animations. | Cross-Site Scripting (XSS) from File Upload (BAC) |
| MapSVG Lite | Arbitrary File Upload (BAC) |
| MapSVG Lite | Broken Access Control (BAC) |
| Master Slider | Broken Access Control (BAC) |
| MasterStudy LMS | Broken Access Control (BAC) |
| Mayosis Core | Unauthenticated Arbitrary File Read (BAC) |
| mb.YTPlayer | Broken Access Control (BAC) |
| Media Library Downloader | Broken Access Control (BAC) |
| Memberpress | Unauthenticated Content Restriction Bypass (BAC) to Private Information Exposure |
| Minimalistic Event Manager | Broken Access Control (BAC) |
| Mobile App Canvas | Broken Access Control (BAC) |
| Motors | Missing Authorization (BAC) to Arbitrary Plugin Installation (BAC) |
| Motors | Missing Authorization (BAC) to Wizard Set-up |
| MP3 Audio Player for Music, Radio & Podcast by Sonaar | Broken Access Control (BAC) |
| My Tickets | Privilege Escalation (BAC) |
| MyBookProgress by Stormhill Media | Broken Access Control (BAC) |
| Name Directory | Broken Access Control (BAC) |
| NanoSupport | Broken Access Control (BAC) |
| Ni WooCommerce Cost Of Goods | Broken Access Control (BAC) |
| Ni WooCommerce Product Enquiry | Broken Access Control (BAC) |
| Nomupay Payment Processing Gateway | Arbitrary File Download (BAC) |
| Ocean Extra | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| Official CleverReach Plugin for WooCommerce | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| OpenAI Tools for WordPress & WooCommerce | Broken Access Control (BAC) |
| ORDER POST | Unauthenticated Arbitrary Shortcode Execution (BAC) |
| Oxygen MyData for WooCommerce | Arbitrary File Deletion (BAC) |
| Paid Videochat Turnkey Site | Broken Authentication (BAC) |
| Payday | Broken Access Control (BAC) |
| pCloud Backup | Broken Access Control (BAC) |
| Pearl | Broken Access Control (BAC) |
| Photobox Theme | Arbitrary File Upload (BAC) |
| Pin Generator | Broken Access Control (BAC) |
| Piotnet Forms | Path Traversal (BAC) |
| Plugin Central | Cross-Site Request Forgery (CSRF) and Arbitrary File Deletion (BAC) |
| PostmarkApp Email Integrator | Broken Access Control (BAC) |
| PowerPress Podcasting | Arbitrary File Upload (BAC) |
| Print Science Designer | Arbitrary File Download (BAC) |
| Printus | Broken Access Control (BAC) |
| Privyr CRM Integration | Broken Access Control (BAC) |
| Processing Projects | Arbitrary File Upload (BAC) |
| Publitio | Broken Access Control (BAC) |
| Publitio | Broken Access Control (BAC) |
| Publitio | Arbitrary File Read (BAC) |
| QR Code Tag for WC | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| Quentn WP | Privilege Escalation (BAC) |
| Question Answer | Broken Access Control (BAC) |
| Rankology SEO – On-site SEO | Privilege Escalation (BAC) |
| Real Estate 7 Theme | Privilege Escalation (BAC) |
| Real Estate 7 Theme | (Seller) Arbitrary File Upload (BAC) |
| Reales WP Theme | Missing Authorization (BAC) to Unauthenticated Attachment Deletion and Favorite Property Updates |
| RepairBuddy | Broken Access Control (BAC) |
| Residential Address Detection | Broken Access Control (BAC) |
| RestroPress | Broken Access Control (BAC) |
| Review Manager | Broken Access Control (BAC) |
| Revive.so – Bulk Theme Rewrite and Republish Blog Posts | Broken Access Control (BAC) |
| Rezo Theme | Arbitrary File Upload (BAC) |
| Rich Table of Contents | Broken Access Control (BAC) |
| Rich Text Editor | Broken Access Control (BAC) |
| Safe Ai Malware Protection for WP | Broken Access Control (BAC) |
| Salesmate Add-On for Gravity Forms | Broken Access Control (BAC) |
| Salon booking system | Broken Access Control (BAC) |
| Salon booking system | Privilege Escalation (BAC) |
| Sandwich Adsense | Broken Access Control (BAC) |
| SecuPress Free | Missing Authorization (BAC) to Arbitrary Plugin Installation (BAC) |
| SEO Help | Broken Access Control (BAC) |
| Seo Meta Tags | Cross-Site Request Forgery (CSRF) and Privilege Escalation (BAC) |
| Service Finder Booking | Unauthenticated Privilege Escalation (BAC) from 'nsl_registration_store_extra_input' |
| Ship Per Product | Broken Access Control (BAC) |
| ShipDepot for WooCommerce | Broken Access Control (BAC) |
| Shiptimize for WooCommerce | Settings Change (BAC) |
| Shopify to WooCommerce Migration | Settings Change (BAC) |
| Shopper Approved Reviews | Missing Authorization (BAC) to Arbitrary Options Update (BAC) |
| ShortPixel Adaptive Images | Broken Authentication (BAC) |
| Simple Icons | Broken Access Control (BAC) |
| Simple Sitemap – Create a Responsive HTML Sitemap | Broken Access Control (BAC) |
| Simple Sticky Add To Cart For WooCommerce | Broken Access Control (BAC) |
| Simple Website Logo | Broken Access Control (BAC) |
| Simple WP Events | Arbitrary File Deletion (BAC) |
| Simple:Press | Broken Access Control (BAC) |
| Sirat Theme | Broken Access Control (BAC) |
| Site Notify | Broken Access Control (BAC) |
| Slazzer Background Changer | Broken Access Control (BAC) |
| Sliced Invoices | Broken Access Control (BAC) |
| Slide Theme | Arbitrary File Upload (BAC) |
| Slider Path for Elementor | Broken Access Control (BAC) |
| Small Package Quotes – Worldwide Express Edition | Broken Access Control (BAC) |
| Smart Hashtags [#hashtagger] | Broken Access Control (BAC) |
| Smart Icons For WordPress | Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| Smart Product Review | Unauthenticated Arbitrary File Upload (BAC) |
| SMS Alert Order Notifications – WooCommerce | Unauthenticated Account Takeover (BAC)/ Privilege Escalation (BAC) |
| Smush Image Compression and Optimization | Directory Traversal (BAC) |
| Social proof testimonials and reviews by Repuso | Broken Access Control (BAC) |
| Social Share Buttons & Analytics Plugin – GetSocial.io | Broken Access Control (BAC) |
| Solace Extra | Arbitrary File Upload (BAC) |
| SP Blog Designer | Arbitrary Shortcode Execution (BAC) |
| Specia Companion | Broken Access Control (BAC) |
| Spice Blocks | Broken Access Control (BAC) |
| Spider Elements – Addons for Elementor | Broken Access Control (BAC) |
| Squeeze | Arbitrary File Upload (BAC) |
| StaffList | Broken Access Control (BAC) |
| Starfish Review Generation & Marketing | Arbitrary Option Update to Privilege Escalation (BAC) |
| StaticPress | Broken Access Control (BAC) |
| StoreContrl Woocommerce | Arbitrary File Download (BAC) |
| Streamit Theme | Arbitrary File Download (BAC) |
| Streamit Theme | Arbitrary File Upload (BAC) |
| Streamit Theme | Privilege Escalation (BAC) from User Email Change/Account Takeover (BAC) |
| Style Manager | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| SureTriggers | Authorization Bypass (BAC) |
| Survey Maker | Bypass (BAC) |
| SurveyJS | Broken Access Control (BAC) |
| Swatchly – WooCommerce Variation Swatches for Products | Missing Authorization (BAC) to Limited Options Update (BAC) |
| Swiss Toolkit For WP | Broken Access Control (BAC) |
| Swiss Toolkit For WP | Broken Access Control (BAC) |
| Sync Posts | Arbitrary File Upload (BAC) |
| TableOn – WordPress Posts Table Filterable | Broken Access Control (BAC) |
| Target Video Easy Publish | Arbitrary Shortcode Execution (BAC) |
| TextMe SMS | Broken Access Control (BAC) |
| Theater for WordPress | Broken Access Control (BAC) |
| Themify Edmin Theme | Arbitrary File Upload (BAC) |
| Themify Folo Theme | Arbitrary File Upload (BAC) |
| Themify Newsy Theme | Arbitrary File Upload (BAC) |
| Themify Sidepane WordPress Theme | Arbitrary File Upload (BAC) |
| TuriTop Booking System | Broken Access Control (BAC) |
| Uncanny Automator | Missing Authorization (BAC) to Privilege Escalation (BAC) |
| Unlimited Timeline | Broken Access Control (BAC) |
| Unlimited Timeline | Broken Access Control (BAC) |
| UPC/EAN/GTIN Code Generator | Settings Change (BAC) |
| UrbanGo Membership | Unauthenticated Privilege Escalation (BAC) |
| User Registration | Authentication Bypass (BAC) |
| User Registration | Insecure Direct Object Reference to User Password Update (BAC) |
| User Registration & Membership Pro | Authentication Bypass (BAC) |
| Variable Inspector | Broken Access Control (BAC) |
| Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce | Missing Authorization (BAC) to Unauthenticated Limited Arbitrary Options Update (BAC) |
| Vehica Core | Privilege Escalation (BAC) |
| Vikinger Theme | Privilege Escalation (BAC) from 'vikinger_user_meta_update_ajax' |
| Vitepos | Broken Authentication (BAC) |
| Vitepos | Broken Authentication (BAC) |
| WC Marketplace | Missing Authorization (BAC) to Unauthenticated Table Rates Deletion |
| WebinarPress | Broken Access Control (BAC) |
| Widget Manager Light | Broken Access Control (BAC) |
| Wigi Theme | Arbitrary File Upload (BAC) |
| Woffice Core | Arbitrary File Upload (BAC) |
| Woffice Theme | Authentication Bypass (BAC) from Registration Role |
| Woo Product Feed For Marketing Channels | Broken Access Control (BAC) |
| WooCommerce Loyal Customers | Broken Access Control (BAC) |
| WooCommerce Multilingual & Multicurrency | Broken Access Control (BAC) |
| WooCommerce Product Table Lite | Broken Access Control (BAC) |
| Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic | Broken Access Control (BAC) |
| WordPress Adverts Plugin | Broken Access Control (BAC) |
| WordPress CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin | Unauthenticated Arbitrary File Read (BAC) |
| WordPress Projectopia - Project Magement Plugin | Privilege Escalation (BAC) |
| WordPress REST API Authentication | Settings Change (BAC) |
| WordPress ZoomSounds - WordPress Wave Audio Player with Playlist plugin | Missing Authorization (BAC) to Limited Options Update (BAC) and Settings Manipulation |
| WowStore | Broken Access Control (BAC) |
| WP AutoKeyword | Arbitrary Content Deletion (BAC) |
| WP Clone any post type | Broken Access Control (BAC) |
| WP Customize Login Page | Broken Access Control (BAC) |
| WP Docs | Broken Access Control (BAC) |
| WP Editor | Directory Traversal (BAC) to Arbitrary File Read (BAC) |
| WP Editor | Directory Traversal (BAC) to Arbitrary File Update |
| WP Event Manager | Broken Access Control (BAC) |
| WP Genealogy – Your Family History Website | Broken Access Control (BAC) |
| WP Logger | Broken Access Control (BAC) |
| WP Mobile Bottom Menu | Broken Access Control (BAC) |
| WP Project Manager | Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| WP Project Manager | Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| WP RealEstate | Authentication Bypass (BAC) from 'process_register' |
| WP Remote Thumbnail | Arbitrary File Upload (BAC) |
| WP shop | Cross-Site Request Forgery (CSRF) and Arbitrary File Upload (BAC) |
| WP Simple Booking Calendar | Broken Access Control (BAC) |
| WP Simple HTML Sitemap | Broken Access Control (BAC) |
| WP Statistics | Missing Authorization (BAC) to Arbitrary Plugin Settings Update |
| WP Subscription Forms | Broken Access Control (BAC) |
| WP Tools | Cross-Site Request Forgery (CSRF) and Arbitrary File Deletion (BAC) |
| WP Ultimate CSV Importer | Arbitrary File Deletion (BAC) |
| WP Ultimate CSV Importer | Arbitrary File Upload (BAC) |
| WP User Profiles | Privilege Escalation (BAC) |
| WP Video Playlist | Settings Change (BAC) |
| WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms | Cross-Site Request Forgery (CSRF) and Settings Change (BAC) |
| WP-Advanced-Search | Arbitrary File Upload (BAC) |
| WP-BusinessDirectory | Arbitrary File Deletion (BAC) |
| WPAMS | Arbitrary File Upload (BAC) |
| WPAMS | Arbitrary File Upload (BAC) |
| WPAMS | Privilege Escalation (BAC) |
| WPAMS | Local File Inclusion (LFi) to Privilege Escalation (BAC) |
| WPBookit | Broken Access Control (BAC) |
| WPC Admin Columns | Privilege Escalation (BAC) from User Meta Update |
| WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce | Privilege Escalation (BAC) |
| wpForo Forum | Privilege Escalation (BAC) |
| WPFront User Role Editor | Cross-Site Request Forgery (CSRF) and Privilege Escalation (BAC) from whitelist_options Function |
| WPJobBoard | Path Traversal (BAC) |
| WPMasterToolKit | Arbitrary File Read (BAC) and Write (BAC) |
| wProject Theme | Privilege Escalation (BAC) |
| WPSolr | Cross-Site Request Forgery (CSRF) and Privilege Escalation (BAC) |
| WR Price List Manager For Woocommerce | Arbitrary Content Deletion (BAC) |
| WS Form LITE | Missing Authorization (BAC) to Unauthenticated Private Information Exposure |
| Xelion Webchat | Privilege Escalation (BAC) |
| Xpro Theme Builder | Broken Access Control (BAC) |
| YayExtra | Broken Access Control (BAC) |
| Z Companion | Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| Zephyr Project Manager | Broken Access Control (BAC) |
| Zoho Flow | Broken Access Control (BAC) |
| ZoomSounds | Unauthenticated Arbitrary File Download (BAC) |
| WP BAC & WordPress Broken Access Control reported in 2023: | 931 |
| WP BAC & WordPress Broken Access Control reported in 2024: | 2024 |
| WP BAC & WordPress Broken Access Control reported in 2025: | 1203 |
WHO needs managed WP Maintenance? EVERYBODY!
Today’s reality requires daily clean-ups with database optimisations, weekly updates and upgrades for both free & premium modules, plus the occasional emergency changes when critical vulnerabilities are publicly disclosed without patches. Order WP BAC MAY 2025: WP Broken Access Control Patch Management.
Security is not a single-task job
Need managed WP Security and got no clue where to start? Hire an expert. Pay a coffee per week, its cheaper than 1 hour for a freelancer.
Not sure that our recurrent security offer is worthy of long-term consideration? Contact us today for a Broken Access Control audit! Decide after you compare RISK + IMPACT versus COST.
We’re passionate about helping you grow and make your impact Continue being informed Email (*double opt-in) Vulnerability reports (monthly) owlpower services (monthly) INSPIRATION (weekly) FEATURED (weekly) managed online business for you (tailored for niche needs) NEWS (weekly) Monthly vulnerability reports about WordPress and WooCommerce, plugins, themes. Weekly inspiration, news and…
We’re passionate about helping you grow and make your impact Continue being informed Email (*double opt-in) Vulnerability reports (monthly) owlpower services (monthly) INSPIRATION (weekly) FEATURED (weekly) managed online business for you (tailored for niche needs) NEWS (weekly) Monthly vulnerability reports about WordPress and WooCommerce, plugins, themes. Weekly inspiration, news and…
We’re passionate about helping you grow and make your impact Continue being informed Email (*double opt-in) Vulnerability reports (monthly) owlpower services (monthly) INSPIRATION (weekly) FEATURED (weekly) managed online business for you (tailored for niche needs) NEWS (weekly) Monthly vulnerability reports about WordPress and WooCommerce, plugins, themes. Weekly inspiration, news and…
We’re passionate about helping you grow and make your impact Continue being informed Email (*double opt-in) Vulnerability reports (monthly) owlpower services (monthly) INSPIRATION (weekly) FEATURED (weekly) managed online business for you (tailored for niche needs) NEWS (weekly) Monthly vulnerability reports about WordPress and WooCommerce, plugins, themes. Weekly inspiration, news and…
We’re passionate about helping you grow and make your impact
Continue being informed
Monthly vulnerability reports about WordPress and WooCommerce, plugins, themes.
Weekly inspiration, news and occasional with hand-picked deals. Unsubscribe anytime.
