iControlWP

iControlWP has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 0 high.

The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (50%). Other recurring categories include Incorrect Privilege Assignment.

Every one of the 2 issues recorded for iControlWP has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. iControlWP is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSCritical

9.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all iControlWP vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-34901

iControlWP <= 5.5.3 - Unauthenticated Privilege Escalation

Read the full analysis

Vulnerability Records

2 records


2026-04-07 00:00	iControlWP <= 5.5.3 - Unauthenticated Privilege Escalation iControlWP <= 5.5.3	`CVE-2026-34901`	9.8 Critical	Jarno Vos (jarnovos)	Yes
2025-01-30 00:41	iControlWP – Multiple WordPress Site Manager <= 4.4.5 - Unauthenticated PHP Object Injection iControlWP <= 4.4.5	`CVE-2024-13742`	9.8 Critical	Krzysztof Zając	Yes

Showing 1–2 of 2 reports

Latestv5.6.0

iControlWP

Author

Paul

4.8(63)

96/100

Last Updated

2026-06-03 (3mo ago)

Active Installs

1,000+

Downloads

289,545

Requires WP

4.9+

Requires PHP

7.4+

Tested up to

WP 7.0.4

Created

2012-05-28 (15y ago)

The iControlWP WordPress Security Manager is the only solution you need to manage all your WordPress websites. You need more time and everyday WordPress management eats away at any spare time you create. iControlWP will give you back the time you need to focus on your business. Our Mission: Give you more free time to focus on your core business With iControlWP you need fewer WordPress plugins as many tasks you need to perform fall under its umbrella of features. For example: No extra plugins to backups / restores No extra plugins for uptime monitoring No extra plugins to optimize your databases No extra plugins to clean up old drafts, comments and post revisions No extra plugins to manage WordPress automatic updates With iControlWP you can: Manage ALL WordPress websites from a single, centralized control panel. One-click update WordPress Plugin (premium ones too!), Themes, and the WordPress Core. Bulk update all plugins, themes and WordPress cores. Very finely tune WordPress Automatic Updates for every plugin on every site. Manage CloudFlare settings using our unique CloudFlare integration. Insert Google Analytics Tracking code. Clean up WordPress and Optimize WordPress databases Manage WordPress Security setting across all your sites. Install new WordPress websites automatically, anywhere you have cPanel web hosting Automatically log into your WordPress sites without remembering your WordPress login details. Collect useful visitor site statistics and view them directly from within your control panel.

View on WordPress.org