Wpengine vulnerabilities
We track 7 vulnerabilities in Wpengine products across 5 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest Wpengine vulnerabilities
- 8.8 High severity
faustjs: Insufficient Verification of Data Authenticity
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decr
- 7.5 High severity
Database Backup for WordPress: Missing Authorization
The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wp_db_temp_dir parameter, which controls where database backups ar
- 8.1 High severity
Database Backup for WordPress: Missing Authorization
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check comb
- 7.5 High severity
Database Backup for WordPress: Missing Authorization
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possib
- 9.9 Critical severity
Advanced Custom Fields PRO: Improper Limitation of a Pathname to a Restricted Directory
Vulnerability discovered by executing a planned security audit. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced
- 8.5 High severity
Advanced Custom Fields PRO: Improper Control of Generation of Code
Vulnerability discovered by executing a planned security audit. Improper Control of Generation of Code ('Code Injection') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows Code Injection.This issue affects Advanced Custom Fields PRO: from n/a bef
- 9.8 Critical severity
Better Search Replace: Deserialization of Untrusted Data
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain i