Vulnerabilities in wpengine
10 resultsCVE-2023-6933HIGHBetter Search Replace <= 1.4.4 - Unauthenticated PHP Object InjectionEPSS 68.0%CVE-2026-4812MEDIUMAdvanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query ParametersEPSS 0.9%CVE-2023-6701MEDIUMAdvanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom FieldEPSS 0.5%CVE-2025-11427MEDIUMWP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request ForgeryEPSS 0.5%CVE-2026-4031HIGHDatabase Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup InterceptionEPSS 0.5%CVE-2026-4030HIGHDatabase Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and DeletionEPSS 0.5%CVE-2026-8382MEDIUMAdvanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' ParametersEPSS 0.5%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2026-4029HIGHDatabase Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database ExportEPSS 0.4%CVE-2026-54239HIGHFaustWP — Authentication Bypass via Initialization Vector Modification in Token EnvelopeEPSS 0.3%