Walker Core

Walker Core has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for Walker Core has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Peter Thaleikis. Walker Core is installed on roughly 700 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Walker Core vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-67552

Walker Core <= 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2025-11-19 00:00	Walker Core <= 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting Walker Core <= 1.3.17	`CVE-2025-67552`	6.4 Medium	Peter Thaleikis	Yes
2022-03-04 00:00	Freemius SDK <= 2.4.2 - Missing Authorization Checks Walker Core < 1.1.8	`CVE-2022-4974`	6.3 Medium	Anonymous	Yes

Showing 1–2 of 2 reports

Plugin Profile

Latestv1.3.18

Walker Core

Author

WalkerWP

5.0(1)

100/100

Last Updated

2025-11-27 (10mo ago)

Active Installs

700+

Downloads

33,216

Requires WP

5.9+

Requires PHP

7.3+

Tested up to

WP 6.8.8

Created

2021-05-22 (5y ago)

Walker Core is the companion plugin for WalkerWP Themes, which provides core functionality and custom post type for the themes.

View on WordPress.org