WordPress Users

WordPress Users has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2011 and 2024; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 7.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include SQL Injection.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2024.

All of these findings were reported by Daniel Ruf.

Strategic Overview

Avg CVSSHigh

7.1/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all WordPress Users vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2023-6390

WordPress Users <= 1.4 - Cross-Site Request Forgery to Settings Update

Read the full analysis

Vulnerability Records

2 records


2024-01-03 00:00	WordPress Users <= 1.4 - Cross-Site Request Forgery to Settings Update WordPress Users <= 1.4	`CVE-2023-6390`	4.3 Medium	Daniel Ruf	No
2011-10-07 00:00	WordPress Users <= 1.3 - SQL Injection WordPress Users <= 1.3	`CVE-2011-4669`	9.8 Critical	Anonymous	Yes

Showing 1–2 of 2 reports