Local Development
Local Development has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Local Development has a vendor fix available, so running the current release closes it.
Local Development is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
Local Development <=2.8.2 - Cross-Site Request Forgery to Settings Update
Read the full analysisVulnerability Records
Local Development
Author
Andy Fragen
Places development notice for plugins or themes that are in local development. Notices are placed on the plugins page and the themes page. Prevents updating of selected plugins and themes. Automatically adds plugins and themes under version control. Automatically allows for using a local file server. Allows for bypassing the WordPress 5.2 WSOD Shutdown Handler. Add a warning color to admin bar when running under localhost. Default is on. Add a git host icon to the plugins page. Default is off. No option if GitHub Updater is running. Allows setting of WP_ENVIRONMENT_TYPE in wp-config.php. Pull Requests are welcome against the develop branch on GitHub. Requires PHP 7.4 or greater.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C