AP HoneyPot WordPress Plugin
AP HoneyPot WordPress Plugin has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for AP HoneyPot WordPress Plugin has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Xuan Chien. AP HoneyPot WordPress Plugin is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 3.7.41.
CVE-2025-58855AP HoneyPot WordPress Plugin <= 1.4 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
AP HoneyPot WordPress Plugin
Author
Denis V (Artprima)
AP HoneyPot WordPress Plugin, based on Jan Stępień’s http:BL, allows you to verify IP addresses of clients connecting to your blog against the Project Honey Pot database. Thanks to http:BL API you can quickly check whether your visitor is an email harvester, a comment spammer or any other malicious creature. Communication with verification server is done via DNS request mechanism, which makes the query and response even quicker. Now, thanks to AP HoneyPot WordPress Plugin any potentially harmful clients are denied from accessing your blog and therefore abusing it. Your Feedback Matters Bugs to report? Feature requests? Criticism? New ideas? We want to hear from you! Do not hesitate. Get in touch with us and share your views.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C