Protect WP Admin

Protect WP Admin has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2025; all 4 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Scripting, behind 1 of the records (25%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Incorrect Authorization.

Every one of the 4 issues recorded for Protect WP Admin has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Protect WP Admin is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Protect WP Admin vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2021-24906

Protect WP Admin <= 3.6 - Unauthenticated Plugin Deactivation

Read the full analysis

Vulnerability Records

4 records


2025-12-15 00:00	Protect WP Admin <= 4.1 - Missing Authorization Protect WP Admin <= 4.1	`CVE-2025-64249`	5.3 Medium	Legion Hunter	Yes
2023-06-12 00:00	Protect WP Admin <= 3.8 - Unauthenticated Information Disclosure to Protection Bypass Protect WP Admin <= 3.8	`CVE-2023-3139`	5.3 Medium	Daniel Ruf	Yes
2022-08-05 00:00	Protect WP Admin <= 3.7 - Cross-Site Scripting Protect WP Admin <= 3.7	`N/A`	6.1 Medium	Anonymous	Yes
2021-12-23 00:00	Protect WP Admin <= 3.6 - Unauthenticated Plugin Deactivation Protect WP Admin <= 3.6	`CVE-2021-24906`	7.5 High	Krzysztof Zając	Yes

Showing 1–4 of 4 reports

Latestv4.2

Protect WP Admin

Author

WP-EXPERTS.IN

3.6(50)

72/100

Last Updated

2026-02-05 (7mo ago)

Active Installs

10,000+

Downloads

540,193

Requires WP

6.0+

Requires PHP

Tested up to

WP 6.9.7

Created

2014-10-20 (12y ago)

Protect WP Admin adds an extra security layer to your WP site by allowing you to rename and secure the wp-admin and wp-login.php URLs. Change default admin URL (e.g., /wp-admin to /myadmin) Restrict access to dashboard by roles or specific user IDs Customize login page colors and logo Block access to default login URLs Stop bots and hackers from brute-forcing your login page. This plugin is ideal for any site looking to increase login security without modifying core files. Video Demo: https://youtu.be/Mxr2MLDNACE Pro Add-on Available: Click here to download add-on Features Define Custom WP Admin Login URL (e.g., http://yourdomain.com/myadmin) Add custom logo and styling to login page Restrict wp-admin access to only admin or defined user IDs Redirect all unauthorized users and bots Pro Features Rename wp-admin completely Set login attempt limits Track login history Change usernames More style controls Get the Pro Version: Protect WP Admin Pro License This plugin is licensed under the GPLv2 or later. https://www.gnu.org/licenses/gpl-2.0.html

View on WordPress.org