TM Replace Howdy

TM Replace Howdy has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for TM Replace Howdy has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Chu The Anh. TM Replace Howdy is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.4.34.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all TM Replace Howdy vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2025-49972

TM Replace Howdy <= 1.4.2 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Plugin Profile
Latestv1.4.2

TM Replace Howdy

David Wood

Author

David Wood

5.0(3)
100/100
Last Updated
2015-11-20 (11y ago)
Active Installs
200+
Downloads
13,131
Requires WP
3.8+
Requires PHP
0+
Tested up to
WP 4.4.34
Created
2010-08-13 (16y ago)

The Replace Howdy Plugin is designed to replace the word “Howdy” in the WordPress admin area/admin bar with something else. By default it randomly pulls from a list of several replacement words and phrases such as “Hello”, “Welcome”, and “Get to the choppa”. The plugin also comes with a menu where you can limit it to professional sounding greetings, set a static word or phrase, or add your own list (which can be by itself or added into the default list for even more variety)! List of replacement words/phrases Professional greetings, also part of the default list Chow, Hello, Aloha, Bonjour, Welcome, Greetings, Konnichiwa, Default list Get to the choppa, Live long and prosper, We require a shrubbery, May the force be with you, Pay no attention to the man behind the curtain, Wassap, Don’t mind me, Looking good today, Eat all your vegetables, I can see you right now, I can hear you breathing, Have you showered recently, There is a ninja behind you, Do you know what time it is, Wipe that grin off your face, Don’t make me come down there, You just gained +5 WordPress skills, I know you are sitting at a computer, Did you remember to brush your teeth, Did you put on clean underwear this morning, Don’t read this directly or you will get a lazy eye, A word on support and additional features Due to time constraints, I am not able to keep up with this plugin as much as I would like. If you want to help keep it up do date, feel free to create a pull request on the GitHub repo!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C