WP Basic Elements
WP Basic Elements has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2023; all 2 are fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10. 2023 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Missing Authorization.
Every one of the 2 issues recorded for WP Basic Elements has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by rezaduty. WP Basic Elements is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
WP Basic Elements <= 5.2.15 - Missing Authorization to Plugin Settings Update via wpbe_save_settings
Read the full analysisVulnerability Records
WP Basic Elements
Author
DamirCalusic
WP Basic Elements gives you full control over the features WordPress loads by default. Disable what you don’t need, clean up the front-end markup, and streamline the admin interface — all from a single, modern settings page. Every option is off by default. You choose exactly what to disable, nothing more. What you can do Admin Bar — Remove individual items like the WP logo, New Content, Customize, Updates, Comments, Search, and more Dashboard Widgets — Hide Welcome Panel, At a Glance, Activity, Site Health, Quick Draft, WP Events & News, WooCommerce and Yoast widgets Admin Footer — Replace or hide the left and right footer text User Profile — Hide profile fields (Rich Editing, Color Scheme, Application Passwords, etc.) and remove individual contact methods (Facebook, Instagram, LinkedIn, Twitter/X, and more) Comments — Disable the entire comment system with a single toggle Gutenberg Editor — Turn off Welcome Guide, Fullscreen Mode, Focus Mode, Distraction Free Mode, and Top Toolbar Meta Tags & Head Cleanup — Remove the generator tag, oEmbed links, shortlinks, WLW manifest, adjacent post links, REST API links, RSS feeds, emojis, and pingbacks/trackbacks REST API — Restrict access for non-logged-in users with a configurable whitelist Why WP Basic Elements? Lightweight — no bloat, no frameworks, no external dependencies Opt-in only — safe to activate on any site without side effects Modern UI — clean settings page with sidebar navigation and toggle switches Translatable — ships with 10 languages out of the box Secure — all output escaped, all input sanitized Translations WP Basic Elements plugin can be translated to any language. Currently available translations are listed below. English Swedish (sv_SE) Norwegian Bokmål (nb_NO) Serbian (sr_RS) Danish (da_DK) Croatian (hr) German (de_DE) Polish (pl_PL) Italian (it_IT) Spanish (es_ES) French (fr_FR)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C