🔬 Conversion Rate Optimisation for your 🌐 WordPress & 🛒 WooCommerce: skyrocket sales with modern proven methods! The purpose of recurrent CRO services is to constantly improve the likelihood of visitors taking your desired action on your domain.
Be informed about the latest WP Broken Access Control, identified and reported publicly. WP BAC MAR 2025 is a -33% DECREASE compared to previous month. Consider for your online safety, a managed security AUDIT, – OR – switching with a TOP10LIST alternative WP Security Plugin - OR - Hire professionals for managed Security.
As these non-enforced access cases from publicly reported vulnerable plugins are on your domain, it opens Pandora’s box from a security point of view. The following cases made headlines PUBLICLY just last month in the WP Broken Access Control category:
| 3D Photo Gallery | Missing Authorization (BAC) to Cross-Site Scripting (XSS) |
| A1POST.BG Shipping for Woo | Cross-Site Request Forgery (CSRF) to Privilege Escalation (BAC) |
| ADFO | Deserialization (BAC) of untrusted data |
| aDirectory | Missing Authorization (BAC) to Post Deletion (BAC) |
| Admin and Site Enhancements (ASE) Pro | Privilege Escalation (BAC) |
| Advanced Google reCAPTCHA | Built-in Math CAPTCHA Bypass (BAC) |
| Affiliate Links Lite | Missing Authorization (BAC) to Unauthenticated Import/Export and PHP Object Injection |
| AIO Performance Profiler, Monitor, Optimize, Compress & Debug | Broken Access Control (BAC) |
| All-Images.ai | File Upload (BAC) |
| Analytify | Broken Access Control (BAC) |
| Animated Text Block | Broken Access Control (BAC) |
| Apus Framework | Options Update (BAC) in import_page_options |
| Atarim | Content Deletion (BAC) |
| Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue | Settings Change (BAC) |
| Avada Theme | Unauthenticated Shortcode Execution (BAC) |
| Awesome Event Booking | Broken Access Control (BAC) |
| Bit Assist | Path Traversal (BAC) to File Read (BAC) from downloadResponseFile Function |
| Bit Assist | Path Traversal (BAC) to File Read (BAC) from fileID Parameter |
| Book a Room | Cross-Site Request Forgery (CSRF) to Settings Update (BAC) |
| Booking Calendar | Unauthenticated Post-Confirmation Booking Manipulation (BAC) |
| BookPress – For Book Authors | Broken Access Control (BAC) |
| Bricks Builder Theme | Privilege Escalation (BAC) from create_autosave |
| Brizy | File Upload (BAC) from storeUploads |
| Brizy | Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| C9 Admin Dashboard | Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| Car Dealer Theme | File Deletion (BAC) and Read (BAC) |
| Car Dealer Theme | Missing Authorization (BAC) to Change (BAC) and JS-CSS Files Delete (BAC) |
| Car Dealer Theme | Theme Option Update to Privilege Escalation (BAC) |
| CarSpot Theme | Unauthenticated Password Reset/Account Takeover (BAC) |
| Chaty Pro | File Upload (BAC) |
| Child Themes Helper | Cross-Site Request Forgery (CSRF) to File Deletion (BAC) |
| Classified Listing | Unauthenticated Settings Exposure (BAC) |
| Click Mag Theme | Missing Authorization (BAC) to Options Deletion (BAC) |
| ClickWhale | Cross-Site Request Forgery (CSRF) to Settings Change (BAC) |
| Contact Manager | Unauthenticated Double File Extension Upload (BAC) |
| ConvertPlus | Missing Authorization (BAC) to Options Update (BAC) |
| CURCY | Unauthenticated Shortcode Execution (BAC) from get_products_price Function |
| Custom Post Type Date Archives | Missing Authorization (BAC) to Unauthenticated Shortcode Execution (BAC) |
| Custom Related Posts | Missing Authorization (BAC) to Private Post Search and Relation Updates |
| DefendWP Firewall | Broken Access Control (BAC) |
| DHVC Form | Unauthenticated Privilege Escalation (BAC) |
| Directorist | Privilege Escalation (BAC) and Account Takeover (BAC) from OTP |
| DirectoryPress Frontend | Cross-Site Request Forgery (CSRF) to Listing Status Update (BAC) |
| Disable Elementor Editor Translation | Broken Access Control (BAC) |
| Distance Based Shipping Calculator | Broken Access Control (BAC) |
| Distance Based Shipping Calculator | Settings Change (BAC) |
| Download IP2Location Country Blocker | Missing Authorization (BAC) to Unauthenticated Information Exposure from admin_init Function |
| DSGVO All in one for WP | Cross-Site Request Forgery (CSRF) to Account Deletion (BAC) |
| EAN for WooCommerce | Broken Access Control (BAC) |
| Email Verification for WooCommerce | Authentication Bypass (BAC) from Shortcode |
| Embed RSS | Shortcode Execution (BAC) |
| Enfold Theme | Missing Authorization (BAC) to Private Information Disclosure in avia-export-classphp |
| Essential Blocks for Gutenberg | Broken Access Control (BAC) |
| Eventer | Missing Authorization (BAC) to Bookings Export |
| Eventer | Missing Authorization (BAC) to Unauthenticated Event Ticket Download |
| Event Kikfyre | Broken Access Control (BAC) |
| Events Manager | Broken Access Control (BAC) |
| Event Tickets | Missing Authorization (BAC) to Ticket Deletion (BAC) |
| Everest Forms | Unauthenticated File Upload (BAC), Read (BAC), and Deletion (BAC) |
| Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets | Broken Access Control (BAC) |
| Flexible Wishlist for WooCommerce | Cross-Site Request Forgery (CSRF) to Wishlist Creation/Modification (BAC) |
| FoodBakery | Authentication Bypass (BAC) in foodbakery_parse_request |
| FoodBakery | Unauthenticated File Upload (BAC) |
| FoodBakery | Unauthenticated Privilege Escalation (BAC) in foodbakery_registration_validation |
| Forex Calculators | Missing Authorization (BAC) to Settings Update (BAC) |
| FormCraft 3 | Missing Authorization (BAC) to Plugin Data Export in formcraft-mainphp |
| Fusion Builder | Unauthenticated Shortcode Execution (BAC) |
| GetBookingsWP | Privilege Escalation (BAC) from Account Takeover (BAC) |
| Gift Vouchers | Missing Authorization (BAC) to Unauthenticated Price, Date, and Note Updates |
| Global Gallery - Wordpress Responsive Gallery | Shortcode Execution (BAC) |
| GlobalQuran | Cross-Site Request Forgery (CSRF) to Settings Change (BAC) |
| GPX Viewer | Path Traversal (BAC) |
| Helloprint | File Deletion (BAC) |
| Helloprint | File Deletion (BAC) |
| Houzez Property Feed | Cross-Site Request Forgery (CSRF) to Property Feed Export Deletion (BAC) |
| Indeed API | Cross-Site Request Forgery (CSRF) to Settings Change (BAC) |
| iNET Webkit | Broken Access Control (BAC) |
| Keep Backup Daily | File Download (BAC) |
| K Elements | Unauthenticated Account Takeover (BAC) |
| Login Me Now | Authentication Bypass (BAC) |
| LTL Freight Quotes – FreightQuote Edition | Broken Access Control (BAC) |
| LTL Freight Quotes – GlobalTranz Edition | Missing Authorization (BAC) to Unauthenticated Settings Update (BAC) |
| LTL Freight Quotes – Unishippers Edition | Broken Access Control (BAC) |
| LTL Freight Quotes – Worldwide Express Edition | Content Deletion (BAC) |
| Market Exporter | Broken Access Control (BAC) |
| Media Library Folders | Missing Authorization (BAC) to Plugin Settings Change (BAC) |
| Munk Sites | Cross-Site Request Forgery (CSRF) to Plugin Installation (BAC) |
| Music Sheet Viewer | File Read (BAC) |
| MyTicket Events | Non-Arbitrary File Read (BAC) |
| Nextend Social Login Pro | Authentication Bypass (BAC) from Apple OAuth provider |
| NextMove Lite | Missing Authorization (BAC) to Deactivation Reason Submission |
| NHR Options Table Manager | Deserialization (BAC) of untrusted data |
| Oliver POS | Private Information Exposure to Privilege Escalation (BAC) |
| OnePress Theme | Broken Access Control (BAC) |
| OneStore Sites | Cross-Site Request Forgery (CSRF) to Plugin Installation (BAC) |
| Option Editor | Cross-Site Request Forgery (CSRF) to Options Update (BAC) |
| Order Limit for WooCommerce | Broken Access Control (BAC) |
| Page and Post Lister | Content Deletion (BAC) |
| Paid Videochat Turnkey Site | File Deletion (BAC) |
| Pallet Packaging for WooCommerce | Broken Access Control (BAC) |
| Photo Gallery ( Responsive ) | Cross-Site Request Forgery (CSRF) to Privilege Escalation (BAC) |
| Pie Register Premium | Broken Access Control (BAC) |
| Plugin A/B Image Optimizer | File Download (BAC) |
| Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | Path Traversal (BAC) to File Read (BAC) from template_via_url Function |
| PressMart Theme | Unauthenticated Shortcode Execution (BAC) |
| PrivateContent | Unauthenticated Account Takeover (BAC) |
| Puzzles Theme | Missing Authorization (BAC) to Cross-Site Scripting (XSS) |
| Rank Math SEO | Missing Authorization (BAC) to Schema Deletion (BAC) |
| RapidLoad | Broken Access Control (BAC) |
| Raptive Ads | Missing Authorization (BAC) to Unauthenticated Data/Settings Reset |
| Read More & Accordion | Missing Authorization (BAC) to 'Read More' Post Deletion (BAC) |
| Real Estate 7 Theme | Unauthenticated Privilege Escalation (BAC) to Administrator |
| Real Estate Manager | Captcha Bypass (BAC) |
| Recipe Card Blocks for Gutenberg & Elementor | Broken Access Control (BAC) |
| Residential Address Detection | Option Update to Privilege Escalation (BAC) |
| School Management System – SakolaWP | Cross-Site Request Forgery (CSRF) to Exam Setting Manipulation (BAC) |
| Scratch & Win – Giveaways and Contests | Missing Authorization (BAC) to Unauthenticated Coupon Creation |
| Search with Typesense | Path Traversal (BAC) |
| Security & Malware scan by CleanTalk | Unauthenticated File Upload (BAC) |
| Shopwarden | Cross-Site Request Forgery (CSRF) to Options Update (BAC) |
| Show Me The Cookies | Unauthenticated Shortcode Execution (BAC) |
| Simplified | File Upload (BAC) |
| Slide Banners | Broken Access Control (BAC) |
| Small Package Quotes – Unishippers Edition | Broken Access Control (BAC) |
| SocialV Theme | Missing Authorization (BAC) to File Download (BAC) |
| Sports Rankings and Lists | File Download (BAC) |
| Starter Templates by FancyWP | Cross-Site Request Forgery (CSRF) to Plugin Installation (BAC) |
| Sticky Header On Scroll | Broken Access Control (BAC) |
| Strong Testimonials | Broken Access Control (BAC) |
| Subscriptions & Memberships for PayPal | Cross-Site Request Forgery (CSRF) to Post Deletion (BAC) |
| SVG Support | Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| Team | Missing Authorization (BAC) to Settings Update (BAC) |
| Team Builder | Missing Authorization (BAC) to Settings Update (BAC) |
| Templines Elementor Helper Core | Privilege Escalation (BAC) |
| Theme File Duplicator | File Download (BAC) |
| Theme File Duplicator | File Upload (BAC) |
| The Ultimate WordPress Toolkit – WP Extended | Missing Authorization (BAC) to Unauthenticated Post Order Manipulation (BAC) |
| Trash Duplicate and 301 Redirect | Missing Authorization (BAC) to Unauthenticated Post Deletion (BAC) |
| Uix Shortcodes | Shortcode Execution (BAC) |
| Ultimate Classified Listings | Cross-Site Request Forgery (CSRF) to Account Takeover (BAC) |
| Uncode Core | Shortcode Execution (BAC) in uncode_get_medias |
| Uncode Theme | File Read (BAC) in uncode_recordMedia |
| Uncode Theme | Unauthenticated File Read (BAC) in uncode_admin_get_oembed |
| VideoWhisper Live Streaming Integration | File Deletion (BAC) |
| VideoWhisper Live Streaming Integration | File Download (BAC) |
| VikBooking Hotel Booking Engine & PMS | Cross-Site Request Forgery (CSRF) to Settings Change (BAC) |
| Vitepos | Broken Access Control (BAC) |
| WHMCS Client Area for WordPress by WHMpress | Options Update (BAC) |
| WHMpress | Unauthenticated Local File Inclusion (LFi) to Options Update (BAC) |
| WooCommerce Food - Restaurant Menu & Food ordering | Unauthenticated Shortcode Execution (BAC) from ids |
| WooCommerce Support Ticket System | Missing Authorization (BAC) to Post Deletion (BAC) and Information Exposure |
| WooCommerce Ultimate Gift Card - Create, Sell and Manage Gift Cards with Customized Email Templates | Unauthenticated File Upload (BAC) |
| WordPress FormCraft - Premium WordPress Form Builder plugin | Unauthenticated Cross-Site Scripting (XSS) from SVG File Upload (BAC) |
| WordPress Portfolio Builder – Portfolio Gallery | Missing Authorization (BAC) to Unauthenticated Portfolio Update |
| WP Abstracts | Cross-Site Request Forgery (CSRF) to Account Deletion (BAC) |
| WP All Import | Cross-Site Request Forgery (CSRF) to Imported Content Deletion (BAC) |
| WP All Import Pro | Cross-Site Request Forgery (CSRF) to Imported Content Deletion (BAC) |
| WP-Asambleas | Shortcode Execution (BAC) |
| WP Directorybox Manager | Authentication Bypass (BAC) |
| WP Find Your Nearest | Cross-Site Request Forgery (CSRF) to Settings Change (BAC) |
| wpForo Forum | File Read (BAC) in update |
| WP Job Board Pro | Unauthenticated Privilege Escalation (BAC) from process_register |
| WP Media Category Management | Cross-Site Request Forgery (CSRF) to Settings Update (BAC) |
| WP Project Manager | Missing Authorization (BAC) to Options Update (BAC) |
| Wp Social | Cross-Site Request Forgery (CSRF) to Settings Update (BAC) |
| WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon | Missing Authorization (BAC) to Settings Reset |
| WP Table Manager | Missing Authorization (BAC) to Directory Traversal to Folder/File Name Private Disclosure |
| WPvivid Backup and Migration | File Upload (BAC) from wpvivid_upload_file |
| Zarinpal Paid Download | File Upload (BAC) |
| Zox News Theme | Missing Authorization (BAC) to Options Modification |
| ZoxPress Theme | Missing Authorization (BAC) to Options Deletion (BAC) |
| ZoxPress Theme | Missing Authorization (BAC) to Options Update (BAC) |
| WordPress BAC & WP Broken Access Control reported in 2023: | 931 |
| WordPress BAC & WP Broken Access Control reported in 2024: | 2024 |
| WordPress BAC & WP Broken Access Control reported in 2025: | 649 |
How wonderful would be to simply let others take care of your chores? We absolutely understand why you would want that. This is why we propose this unique campaign: the price of a premium cup of coffee per week, for your first managed service.
Start simply by contacting us with your selections:
We care about the protection of your personal data. Update, subscribe or unsubscribe anytime. Read our Privacy Policy.