WP Customer Area

WP Customer Area has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 12 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 3 of the records (25%). Other recurring categories include Cross-Site Scripting, Authorization Bypass Through User-Controlled Key.

Every one of the 12 issues recorded for WP Customer Area has a vendor fix available, so running the current release closes all known holes.

9 independent researchers contributed these findings, most of them (3) reported by Krzysztof Zając. WP Customer Area is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.9/ 10
Patch Coverage100%
Open

0

Fixed

12

Get automatic notifications for all WP Customer Area vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2026-3464

WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file

Read the full analysis

Vulnerability Records

12 records
2026-07-13 13:11CVE-2026-7640
6.4
Medium
zaimYes
2026-05-01 00:00CVE-2026-42661
5.3
Medium
iamlooperYes
2026-04-17 04:24CVE-2026-3464
8.8
High
shark3yYes
2025-07-21 00:00CVE-2025-60201
8.1
High
LVT-tholv2kYes
2025-06-19 00:00CVE-2025-49982
4.3
Medium
domiee13Yes
2025-01-06 00:00CVE-2024-12280
4.3
Medium
Krugov ArtyomYes
2025-01-06 00:00CVE-2024-12436
4.3
Medium
Bob MatyasYes
2024-01-23 00:00CVE-2024-0665
6.1
Medium
Krzysztof ZającYes
2024-01-10 00:00CVE-2023-6741
4.3
Medium
Krzysztof ZającYes
2024-01-10 00:00CVE-2023-6824
4.3
Medium
Krzysztof ZającYes
Showing 1–10 of 12 reports
WP Customer Area banner
Latestv8.4.1
4.0(89)
80/100
Last Updated
2026-10-26 (2d ago)
Active Installs
10,000+
Downloads
694,976
Requires WP
5.0+
Requires PHP
7.2+
Tested up to
WP 7.1.3
Created
2013-04-30 (14y ago)

WP Customer Area is a modular all-in-one solution to manage private content with WordPress. Sharing files/pages with one or multiple users is one of the main feature provided by our easy-to-use plugin. Give it a try! Add-ons Current features Secure customer area, accessible to logged-in users Private pages, that can be assigned to a particular user and will get listed in its customer area Private files, that can be assigned to a particular user and will get listed in its customer area Customize the plugin appearance using your own themes and templates Extensions and themes are now available! Invoicing, Conversations, Advanced ownership, Projects, and much more! WP Customer Area is available for free and should cover the needs of most users. If you want to encourage us to actively maintain it, or if you need a particular feature not included in the basic plugin, you can buy our premium extensions from our online shop Security Found a security issue? Please report it privately through the Patchstack Vulnerability Disclosure Program, the Wordfence vulnerability disclosure program or security@wp-customerarea.com, not in the support forums. Our response commitments and the list of fixed vulnerabilities are on our security page. Special thanks To Steve Steiner for his intensive testing on the plugin, his bug reports and support. To the translators who send us their translations: Catalan by Amanda Fontana Dutch by Paul Willems and Peter Massar English by Foobar Studio French by Foobar Studio German by Benjamin Oechsler Hungarian by Jagri István Spanish by Ulises and e-rgonomy Brazilian Portuguese by Ricardo Silva and Marcos Meyer Hollerweger Italian by Andrea Starz and Antonio Cicirelli Swedish by Patric Liljestrand Turkish by Mehmet Hakan If you translate the plugin to your language, feel free to send us the translation files, we will include them and give you the credit for it on this page.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C