The WP Remote WordPress Plugin

The WP Remote WordPress Plugin has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 8.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Use Of Cryptographically Weak Pseudo-Random Number Generator (PRNG).

Every one of the 2 issues recorded for The WP Remote WordPress Plugin has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. The WP Remote WordPress Plugin is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSHigh

8.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all The WP Remote WordPress Plugin vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-19718

The WP Remote WordPress Plugin, Malcare Security, and BlogVault Backup & Staging < 6.65 - Unauthenticated Site Takeover via Brute Force

Read the full analysis

Vulnerability Records

2 records


2026-08-24 00:00	The WP Remote WordPress Plugin, Malcare Security, and BlogVault Backup & Staging < 6.65 - Unauthenticated Site Takeover via Brute Force The WP Remote WordPress Plugin < 6.65	`CVE-2026-19718`	9.8 Critical	Jakub Herman	Yes
2021-11-29 00:00	The WP Remote WordPress Plugin <= 4.64 - Reflected Cross-Site Scripting The WP Remote WordPress Plugin <= 4.64	`N/A`	6.1 Medium	WPScanTeam	Yes

Showing 1–2 of 2 reports

Latestv6.72

The WP Remote WordPress Plugin

Author

akshatc

4.6(74)

92/100

Last Updated

2026-08-28 (15d ago)

Active Installs

30,000+

Downloads

2,268,859

Requires WP

4.0+

Requires PHP

7.0+

Tested up to

WP 7.1

Created

2010-06-10 (17y ago)

The WP Remote WordPress Plugin works with WP Remote to enable you to remotely manage and update all your WordPress sites. WP Remote has been acquired by BlogVault. Why you need WP Remote? Features Free to update an unlimited number of sites. Track and update all of your WordPress sites from one place. Track and update all of your WordPress plugins and themes from one place. Install and activate plugins and themes from the one place. Support You can email us at support@wpremote.com for support.

View on WordPress.org