WEDOS | Protection & Cache Performance

WEDOS | Protection & Cache Performance has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for WEDOS | Protection & Cache Performance has a vendor fix available, so running the current release closes it.

All of these findings were reported by Nabil Irawan. WEDOS | Protection & Cache Performance is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all WEDOS | Protection & Cache Performance vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2025-60130

WEDOS Global <= 1.2.2 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
WEDOS | Protection & Cache Performance banner
Latestv2.2.1

WEDOS | Protection & Cache Performance

wedos.com

Author

wedos.com

3.8(4)
76/100
Last Updated
2026-07-03 (2mo ago)
Active Installs
400+
Downloads
16,475
Requires WP
6.7+
Requires PHP
8.2+
Tested up to
WP 7.0.4
Created
2023-09-26 (3y ago)

Activate WEDOS Global protection — WAF, DDoS protection and CDN for your WordPress website. WEDOS Global (CDN Cache & Security) WEDOS Global Protection plugin helps site administrators activate WEDOS.protection from inside WordPress. The plugin provides a simple landing page for non-technical users, guided website and DNS setup, a dashboard with protection status, and a consent step before any external service activation request is sent. Cloud WAF & DDoS Protection By filtering traffic and blocking harmful cyberattacks on cloud servers, our WAF provides protection for your WordPress websites without putting any extra load on your local resources. Global CDN Cache The WEDOS Global CDN will ensure a significant increase of your WordPress loading speed, and better overall server response all around the world. Links to Documentation and Other Sources WEDOS Global Knowledge Base Community Help External Services This plugin connects to the following external services: WEDOS Global Protection (plugin.wedos.global) Verify domain ownership via a local verification file Register and activate the domain protection service Check the protection and DNS status Data sent: domain name, server IP address, admin email address, unique request ID. No personal visitor data is ever transmitted. WEDOS CDN (wp-cdn.wedos.com) Serves WordPress core and WooCommerce static assets (JS, CSS) from WEDOS CDN edge nodes Fetches a manifest file listing available asset versions and their SHA-256 hashes Assets are only rewritten when local file hash matches the CDN manifest — no data about visitors is transmitted CDN is opt-in and can be disabled at any time from the dashboard Anonymous telemetry (plugin.wedos.global/cdn-plugin/telemetry.php) Sends anonymous usage statistics once daily when opted in: plugin version, WordPress version, rewrite count No domain name, no IP address, no personal data is included Subscription management (plugin.wedos.global) Used only when you start a free trial or subscribe to a paid plan (Standard, Premium) Data sent: domain name, admin email address, selected plan identifier Subscription status is queried periodically to determine which paid features (e.g. detailed visitor geography) are unlocked The free plan does not require any subscription data exchange Billing provider (FastSpring) When you purchase a paid plan, your order is processed by FastSpring (fastspring.com) FastSpring acts as the merchant of record for the transaction See FastSpring’s privacy policy for details on data they collect during checkout Bundled Third-Party Libraries The plugin ships with the following open-source libraries (no external network calls — all bundled locally): Chart.js 4.4.0 (MIT license) Used for analytics charts (requests over time, top countries bars) Source: https://www.chartjs.org/ License: https://github.com/chartjs/Chart.js/blob/master/LICENSE.md jsvectormap 1.7.0 (MIT license) Used to render the interactive world map in the Visitor Geography section (paid feature only — loaded when geographic analytics are unlocked by the active plan) Source: https://github.com/themustafaomar/jsvectormap Map data renders aggregated country traffic counts received from the WEDOS Global Protection backend; no visitor data is sent anywhere License: https://github.com/themustafaomar/jsvectormap/blob/master/LICENSE The service is provided by WEDOS Group SA, 7 Rue Robert Stumper, L-2557 Luxembourg, EU. Terms of Service Privacy Policy By activating the plugin and clicking “Create request”, you explicitly consent to your domain data being sent to the WEDOS Global Protection service.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C