Dollie Site Companion
Dollie Site Companion has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (100%).
The one issue recorded for Dollie Site Companion has a vendor fix available, so running the current release closes it.
All of these findings were reported by Francesco Carlucci. Dollie Site Companion is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2024-12099Dollie Hub – Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure
Read the full analysisVulnerability Records

Dollie Site Companion
Author
getdollie
Dollie is a workspace where your team and its Agents plan and coordinate work. A Site Record in Dollie represents one website. This plugin connects a WordPress site to its Site Record and answers Dollie’s requests for information about the site. Once connected, Dollie can read: Site details — name, tagline, site icon, WordPress and PHP versions, language, time zone, whether a WordPress update is available, and counts of published posts, pages, users and comments. Software — installed plugins and themes with their versions, which are active, and which have updates available. Update information comes from what WordPress already knows; the plugin does not check for updates itself. Recent activity — a history the plugin keeps on this site: plugins and themes installed, updated, activated, deactivated or deleted; WordPress updates; posts and pages saved, trashed or deleted; changes to a short list of site settings; users added, updated or deleted; administrator logins. Each entry names the WordPress user who made the change. WordPress abilities — on WordPress 6.9 and later, the abilities that other plugins on this site mark as public for MCP. Dollie can run one of these only as the administrator who connected the site, and only while that user is still an administrator. Dollie asks for this information when your team or an Agent needs it. The plugin does not send anything on a schedule and makes no outgoing requests of its own. Preview inside Dollie A connected site can be shown in Dollie’s work panel next to the Agent. The plugin allows only the Dollie address the site was connected to to show it in a frame, and only for pages opened from Dollie’s preview. The preview shows the site as whoever is signed in to WordPress in that browser; it never signs anyone in. If you are not signed in, a bar offers to sign you in inside the preview. Some browsers block sign-in inside a frame; in that case, open the site in a new tab from the panel. What this plugin does not do It does not host, back up, update, secure or monitor your site, and it does not run commands on it. Those stay with your hosting and maintenance providers.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C