💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

Vulnerabilities protected by our Directory Traversal firewall rule

1,764,596

Attacks Blocked in Past 24 Hours

Showing 141-160 of 315 Vulnerabilities

Product Input Fields for WooCommerce <= 1.2.6 - Missing Authorization

7.5

CVE-2020-36696

Aug 3, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal

6.5

CVE-2020-36728

Jul 7, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Simple File List <= 4.2.7 - Arbitrary File Deletion

6.5

CVE-2020-12832

May 16, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

WordPress File Upload <= 4.12.2 - Directory Traversal to Remote Code Execution

9.8

CVE-2020-10564

Mar 13, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Duplicator < 1.3.28 - Directory Traversal

7.5

CVE-2020-11738

Feb 28, 2020

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

ARforms <= 3.7.1 - Unauthenticated Arbitrary File Deletion

7.5

CVE-2019-16902

Oct 11, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read

9.8

CVE-2019-25213

Sep 9, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ultimate Member <= 2.0.3 - Directory Traversal

4.3

CVE-2018-0586

Aug 12, 2019

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

WP Fastest Cache <= 0.8.9.5 - Directory Traversal

9.1

CVE-2019-13635

Jul 28, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

WPS Child Theme Generator < 1.2 - Directory Traversal

9.8

CVE-2019-15822

Jul 23, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Adaptive Images for WordPress <= 0.6.66 - Arbitrary File Deletion

7.5

CVE-2019-14206

Jul 19, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Ad Inserter <= 2.4.19 - Authenticated Path Traversal

7.5

CVE-2019-15323

Jul 12, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Insert or Embed Articulate Content into WordPress < 4.29991 - Directory Traversal

6.5

CVE-2019-15648

Jul 2, 2019

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Newsletters <= 4.6.18 - Directory Traversal

8.8

CVE-2019-14788

Jul 1, 2019

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Import and export users and customers <= 1.14.2.1 - Directory Traversal

7.5

CVE-2019-15326

Jun 20, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Simple File List <= 3.2.4 - Arbitrary File Deletion

8.6

CVE ID Unknown

May 23, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Simple File List <= 3.2.7 - Arbitrary File Download

7.5

CVE-2022-1119

May 23, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.0.45 - Arbitrary File Deletion/Read

9.4

CVE ID Unknown

May 13, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

WP Cost Estimation < 9.660 - Upload Directory Traversal

6.5

CVE ID Unknown

Feb 14, 2019

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Health Check & Troubleshooting <= 1.2.3 - Path Traversal

4.3

CVE ID Unknown

Jan 25, 2019

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Title	CVE ID	CVSS	Vector	Date
Product Input Fields for WooCommerce <= 1.2.6 - Missing Authorization	CVE-2020-36696	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	August 3, 2020
Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal	CVE-2020-36728	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	July 7, 2020
Simple File List <= 4.2.7 - Arbitrary File Deletion	CVE-2020-12832	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	May 16, 2020
WordPress File Upload <= 4.12.2 - Directory Traversal to Remote Code Execution	CVE-2020-10564	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	March 13, 2020
Duplicator < 1.3.28 - Directory Traversal	CVE-2020-11738	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	February 28, 2020
ARforms <= 3.7.1 - Unauthenticated Arbitrary File Deletion	CVE-2019-16902	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	October 11, 2019
Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read	CVE-2019-25213	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	September 9, 2019
Ultimate Member <= 2.0.3 - Directory Traversal	CVE-2018-0586	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	August 12, 2019
WP Fastest Cache <= 0.8.9.5 - Directory Traversal	CVE-2019-13635	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	July 28, 2019
WPS Child Theme Generator < 1.2 - Directory Traversal	CVE-2019-15822	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	July 23, 2019
Adaptive Images for WordPress <= 0.6.66 - Arbitrary File Deletion	CVE-2019-14206	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	July 19, 2019
Ad Inserter <= 2.4.19 - Authenticated Path Traversal	CVE-2019-15323	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	July 12, 2019
Insert or Embed Articulate Content into WordPress < 4.29991 - Directory Traversal	CVE-2019-15648	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	July 2, 2019
Newsletters <= 4.6.18 - Directory Traversal	CVE-2019-14788	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	July 1, 2019
Import and export users and customers <= 1.14.2.1 - Directory Traversal	CVE-2019-15326	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	June 20, 2019
Simple File List <= 3.2.4 - Arbitrary File Deletion		8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N	May 23, 2019
Simple File List <= 3.2.7 - Arbitrary File Download	CVE-2022-1119	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	May 23, 2019
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.0.45 - Arbitrary File Deletion/Read		9.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	May 13, 2019
WP Cost Estimation < 9.660 - Upload Directory Traversal		6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	February 14, 2019
Health Check & Troubleshooting <= 1.2.3 - Path Traversal		4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	January 25, 2019

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation