WP Security Master
WP Security Master has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for WP Security Master has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Chu The Anh. The current release is tested up to WordPress 5.2.26.
CVE-2025-49440WP Security Master <= 1.0.2 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
WP Security Master
Author
Vuong Nguyen
Securing your WordPress by deliberately disabling all functions in dashboard. Re-activate the site by providing the hashed password. It secures your site by providing another layer of authorization. Overview WP Security Master enables you to: Automatically lock the dashboard by providing another passcode. Enhancing the security Please Note You need to remember your passcode to access. Otherwise, your admin dashboard will be locked. WP Security Master only supports user with “administrator” role. Disclaimer This plugin does not require any technical knowledge. Active Contributors Vuong Nguyen at https://tudien.net
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C