💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

Vulnerabilities protected by our Directory Traversal firewall rule

1,742,844

Attacks Blocked in Past 24 Hours

Showing 201-220 of 315 Vulnerabilities

WPvivid Backup 0.9.76 - Authenticated (Administrator+) Arbitrary File Deletion

6.5

CVE ID Unknown

Aug 29, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Migration, Backup, Staging – WPvivid <= 0.9.75 - Authenticated (Administrator+) Path Traversal

6.5

CVE-2022-2863

Aug 22, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Export All URLs <= 4.3 - Arbitrary File Deletion

6.5

CVE-2022-2638

Aug 8, 2022

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read

6.5

CVE-2022-1390

Apr 20, 2022

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

WordPress File Upload / WordPress File Upload Pro <= 4.16.2 - Authenticated (Contributor+) Path Traversal

6.5

CVE-2021-24962

Mar 1, 2022

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

WP Fastest Cache <= 0.8.9.0 - Directory Traversal to Arbitrary File Deletion

6.5

CVE-2019-6726

Jan 24, 2022

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Simple Download Monitor <= 3.9.4 - Contributor+ Arbitrary File Download

6.5

CVE-2021-24692

Sep 2, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

WP Fastest Cache <= 0.9.1.6 - Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion

6.5

CVE-2021-20714

Apr 27, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal

6.5

CVE-2020-36728

Jul 7, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Simple File List <= 4.2.7 - Arbitrary File Deletion

6.5

CVE-2020-12832

May 16, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Insert or Embed Articulate Content into WordPress < 4.29991 - Directory Traversal

6.5

CVE-2019-15648

Jul 2, 2019

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

WP Cost Estimation < 9.660 - Upload Directory Traversal

6.5

CVE ID Unknown

Feb 14, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

BuddyPress Xprofile Custom Fields Type <= 2.6.3 - Arbitrary File Deletion

6.5

CVE ID Unknown

Jan 4, 2018

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Insert Pages < 3.2.4 - Authenticated Directory Traversal

6.5

CVE-2017-18586

Sep 29, 2017

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

WordPress Core < 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access

6.5

CVE-2016-7169

Sep 7, 2016

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Nelio AB Testing < 4.5.0 - Directory Traversal

6.5

CVE-2016-10977

May 10, 2016

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NextGen Gallery <= 2.1.7 - Path Traversal

6.5

CVE ID Unknown

Aug 28, 2015

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Easy2Map <= 1.2.4 - Directory Traversal

6.5

CVE-2015-4616

Jun 8, 2015

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Crayon Syntax Highlighter <= 2.6.10 - Directory Traversal

6.5

CVE ID Unknown

Apr 14, 2015

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Marketplace <= 2.4.0 - Path Traversal

6.5

CVE-2014-9014

Mar 21, 2015

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Title	CVE ID	CVSS	Vector	Date
WPvivid Backup 0.9.76 - Authenticated (Administrator+) Arbitrary File Deletion		6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H	August 29, 2022
Migration, Backup, Staging – WPvivid <= 0.9.75 - Authenticated (Administrator+) Path Traversal	CVE-2022-2863	6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N	August 22, 2022
Export All URLs <= 4.3 - Arbitrary File Deletion	CVE-2022-2638	6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H	August 8, 2022
Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read	CVE-2022-1390	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	April 20, 2022
WordPress File Upload / WordPress File Upload Pro <= 4.16.2 - Authenticated (Contributor+) Path Traversal	CVE-2021-24962	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	March 1, 2022
WP Fastest Cache <= 0.8.9.0 - Directory Traversal to Arbitrary File Deletion	CVE-2019-6726	6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H	January 24, 2022
Simple Download Monitor <= 3.9.4 - Contributor+ Arbitrary File Download	CVE-2021-24692	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	September 2, 2021
WP Fastest Cache <= 0.9.1.6 - Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion	CVE-2021-20714	6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H	April 27, 2021
Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal	CVE-2020-36728	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	July 7, 2020
Simple File List <= 4.2.7 - Arbitrary File Deletion	CVE-2020-12832	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	May 16, 2020
Insert or Embed Articulate Content into WordPress < 4.29991 - Directory Traversal	CVE-2019-15648	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	July 2, 2019
WP Cost Estimation < 9.660 - Upload Directory Traversal		6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	February 14, 2019
BuddyPress Xprofile Custom Fields Type <= 2.6.3 - Arbitrary File Deletion		6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	January 4, 2018
Insert Pages < 3.2.4 - Authenticated Directory Traversal	CVE-2017-18586	6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N	September 29, 2017
WordPress Core < 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access	CVE-2016-7169	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	September 7, 2016
Nelio AB Testing < 4.5.0 - Directory Traversal	CVE-2016-10977	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	May 10, 2016
NextGen Gallery <= 2.1.7 - Path Traversal		6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	August 28, 2015
Easy2Map <= 1.2.4 - Directory Traversal	CVE-2015-4616	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	June 8, 2015
Crayon Syntax Highlighter <= 2.6.10 - Directory Traversal		6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	April 14, 2015
Marketplace <= 2.4.0 - Path Traversal	CVE-2014-9014	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	March 21, 2015

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation