💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

Vulnerabilities protected by our Malicious File Upload (PHP) firewall rule

405,534

Attacks Blocked in Past 24 Hours

Showing 141-160 of 458 Vulnerabilities

Brizy Page Builder <= 2.3.11 - Authenticated File Upload and Path Traversal

8.8

CVE-2021-38346

Oct 13, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AccessPress Themes and Plugin <= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVE-2021-39317

Oct 6, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

MStore API < 3.4.5 - Arbitrary File Upload

9.8

CVE ID Unknown

Oct 5, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

3DPrint Lite < 1.9.1.5 - Arbitrary File Upload

9.8

CVE-2021-4436

Sep 23, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Download from files <= 1.48 - Arbitrary File Upload

9.8

CVE ID Unknown

Sep 13, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Simple Schools Staff Directory <= 1.1 - Authenticated (Admin+) Arbitrary File Upload

7.2

CVE-2021-24663

Aug 23, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Shopp <= 1.4 - Unauthenticated Arbitrary File Upload

9.8

CVE-2021-24493

Aug 17, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Email Artillery (MASS EMAIL) <= 4.1 - Arbitrary File Upload

7.2

CVE-2021-24490

Aug 16, 2021

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

WordPress Download Manager <= 3.1.24 - Authenticated File Upload

7.5

CVE-2021-34639

Jul 29, 2021

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SP Project & Document Manager <= 4.23 - Subscriber+ Arbitrary File Upload

8.8

CVE-2021-4225

Jul 28, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Workreap - Freelance Marketplace and Directory WordPress Theme < 2.2.2 - Arbitrary File Upload

9.8

CVE-2021-24499

Jul 2, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PWA for WP & AMP <= 1.7.32 - Arbitrary File Upload

8.8

CVE-2021-4354

Jul 1, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload

9.8

CVE-2021-34624

Jun 28, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation

9.8

CVE-2021-34623

Jun 28, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload

9.8

CVE-2021-4449

Jun 24, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Recently <= 3.0.4 - Arbitrary File Upload to Remote Code Exectution

8.8

CVE-2021-4382

Jun 7, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution

9.8

CVE-2020-24186

Jun 6, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fancy Product Designer <= 4.6.8 - Unauthenticated Arbitrary File Upload

9.8

CVE-2021-24370

Jun 1, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Gallery From Files <= 1.60 - Arbitrary File Upload

9.8

CVE ID Unknown

May 26, 2021

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

External Media <= 1.0.33 - Authenticated Arbitrary File Upload

8.8

CVE-2021-24311

May 13, 2021

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Title	CVE ID	CVSS	Vector	Date
Brizy Page Builder <= 2.3.11 - Authenticated File Upload and Path Traversal	CVE-2021-38346	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	October 13, 2021
AccessPress Themes and Plugin <= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload	CVE-2021-39317	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	October 6, 2021
MStore API < 3.4.5 - Arbitrary File Upload		9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	October 5, 2021
3DPrint Lite < 1.9.1.5 - Arbitrary File Upload	CVE-2021-4436	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	September 23, 2021
Download from files <= 1.48 - Arbitrary File Upload		9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	September 13, 2021
Simple Schools Staff Directory <= 1.1 - Authenticated (Admin+) Arbitrary File Upload	CVE-2021-24663	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	August 23, 2021
Shopp <= 1.4 - Unauthenticated Arbitrary File Upload	CVE-2021-24493	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	August 17, 2021
Email Artillery (MASS EMAIL) <= 4.1 - Arbitrary File Upload	CVE-2021-24490	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	August 16, 2021
WordPress Download Manager <= 3.1.24 - Authenticated File Upload	CVE-2021-34639	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	July 29, 2021
SP Project & Document Manager <= 4.23 - Subscriber+ Arbitrary File Upload	CVE-2021-4225	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	July 28, 2021
Workreap - Freelance Marketplace and Directory WordPress Theme < 2.2.2 - Arbitrary File Upload	CVE-2021-24499	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	July 2, 2021
PWA for WP & AMP <= 1.7.32 - Arbitrary File Upload	CVE-2021-4354	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	July 1, 2021
ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload	CVE-2021-34624	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 28, 2021
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation	CVE-2021-34623	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 28, 2021
ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload	CVE-2021-4449	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 24, 2021
Recently <= 3.0.4 - Arbitrary File Upload to Remote Code Exectution	CVE-2021-4382	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	June 7, 2021
Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution	CVE-2020-24186	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 6, 2021
Fancy Product Designer <= 4.6.8 - Unauthenticated Arbitrary File Upload	CVE-2021-24370	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	June 1, 2021
Gallery From Files <= 1.60 - Arbitrary File Upload		9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	May 26, 2021
External Media <= 1.0.33 - Authenticated Arbitrary File Upload	CVE-2021-24311	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	May 13, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation