Hide Plugins

Hide Plugins has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Hide Plugins has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Nabil Irawan. Hide Plugins is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.5.33.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Hide Plugins vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2025-62115

Hide Plugins <= 1.0.4 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Hide Plugins banner
Latestv1.0.4

Hide Plugins

ThemeBoy

Author

ThemeBoy

4.8(9)
96/100
Last Updated
2016-04-22 (11y ago)
Active Installs
1,000+
Downloads
19,890
Requires WP
3.0+
Requires PHP
0+
Tested up to
WP 4.5.33
Created
2014-05-21 (13y ago)

Hide Plugins is a light-weight plugin that gives a single admin user the ability to hide plugins prevent them from being activated, deactivated, or deleted by clients and other users, including administrators. By activating Hide Plugins, you will be able to see all plugins and a toggle to hide each plugin from other users on the Plugins page. Hide Plugins will always remain hidden. Note that the dropdown on the Edit Plugins page will not be affected, since it does not have a filter to hook into. Hidden plugins will remain active, so traces of the plugin in areas other than the Plugins page (like options pages in the admin menu) will still be visible. If you also want to hide menus, we recommend using Admin Menu Editor.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C