WPPerformanceTester
WPPerformanceTester has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for WPPerformanceTester has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2023.
All of these findings were reported by Nguyen Xuan Chien. WPPerformanceTester is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.5.10.
CVE-2023-49844WPPerformanceTester <= 2.0.0 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
WPPerformanceTester
Author
kohashi
WPPerformanceTester was written as a tool to benchmark WordPress in the WordPress Hosting Performance Benchmarks (2015) by Review Signal. Current benchmarks are on WPHostingBenchmarks.com. It was designed to test the server’s performance by stressing PHP, MySql and running $wpdb queries. WPPerformanceTester performs the following tests Math – 100,000 math function tests String Manipulation – 100,000 string manipulation tests Loops – 1,000,000 loop iterations Conditionals – 1,000,000 conditional logic checks MySql (connect, select, version, aes_encrypt) – basic mysql functions and 5,000,000 AES_ENCRYPT() iterations \$wpdb – 250 insert, select, update and delete operations through \$wpdb It also allows you to see how your server’s performance stacks up against our industry benchmark. Our industry benchmark is the average of all submitted test results. Notes on Performance Performance can be measured in a lot of ways. WPPerformanceTester was simply one component of a much larger performance benchmark. It tests a single server (or node) that it is running on. So if you’re considering looking at the results from a clustered or distributed setup, it may give you limited insight into how well your whole system performs. WPPerformanceTester is about the raw speed a system has to execute code and perform database operations. Real website performance isn’t always correlated with raw speed. A seemingly slow website could have a very fast WPPerformanceTester result. There are lots of layers (namely caching) in making a WordPress website fast. A good caching layer will almost always outperform computing power. But when the caching layers are equal, raw speed can make a difference. WPPerformanceTester is simply one tool to add to your toolkit in measuring performance. You should have a variety of others to test other facets of performance. Known Issues If the script times out (max_execution_time limit) it will not show any results. You can solve this by increasing the max_execution_time in the php.ini. Some plugins may also cause WPPerformanceTester to run exceptionally slow and make it more likely to hit this limit. One such plugin is VersionPress. You can temporarily disable plugins that might be interfering with it as an alternative way to run it. Note: It’s always best to BACKUP EVERYTHING before running ANY new plugin or making changes to your WordPress install.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C