Known vulnerabilities in Wordfence Security – Firewall, Malware Scan, and Login Security

Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.

12Reported vulnerabilities

7.2Highest CVSS score

9.0.0Latest version

5,000,000+Active installs

What to do now

Update Wordfence Security – Firewall, Malware Scan, and Login Security to 7.6.1 or later. 11 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 10, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2019-9669	Medium 6.1	1.0%	7.2.3 to 7.2.3 (inclusive)	—	April 25, 2019
CVE-2014-4664	Medium 4.3	2.3%	5.0.1 to 5.0.1 (inclusive) 5.0.2 to 5.0.2 (inclusive) 5.0.3 to 5.0.3 (inclusive) 5.0.4 to 5.0.4 (inclusive) 5.0.5 to 5.0.5 (inclusive) 5.0.6 to 5.0.6 (inclusive) 5.0.7 to 5.0.7 (inclusive) 5.0.8 to 5.0.8 (inclusive) 5.0.9 to 5.0.9 (inclusive) 5.1.1 to 5.1.1 (inclusive) 5.1.2 to 5.1.2 (inclusive)	`5.1.4`	November 6, 2014
WF-47938357-7d51-4d62-a08c-4b2bf3f3a062	High 7.2	—	5.2.3 and earlier	`5.2.4`	September 27, 2014
WF-fdfa2336-dda2-4945-9278-1a85f8b5f88b	High 7.2	—	5.2.3 and earlier	`5.2.4`	September 14, 2014
WF-f315fff8-d616-4a5c-91bc-d8b0ec0f028f	High 7.2	—	Before 5.2.3	`5.2.3`	September 8, 2014
WF-63a2d09d-9cb8-47ba-8e40-5b43894552e3	High 7.2	—	3.8.1 and earlier	`3.8.3`	August 1, 2014
WF-be700f83-248f-4d22-b53d-7cc61e1f7d7d	Medium 6.5	—	Before 5.2.4	`5.2.4`	September 14, 2014
WF-93f9862f-745f-44d5-ac49-f8d2d19b35ed	Medium 6.5	—	3.3.6 and earlier	`3.3.7`	October 19, 2012
WF-809d0632-39a7-44a7-b368-9dc58270c666	Medium 6.1	—	6.1.1 to 6.1.6 (inclusive)	`6.1.7`	May 10, 2016
WF-bdc39e21-f39c-4581-895a-04e352e9b383	Medium 6.1	—	Before 3.3.7	`3.3.7`	October 19, 2012
CVE-2022-3144	Medium 4.8	0.7%	7.6.0 and earlier	`7.6.1`	September 23, 2022
WF-e7819dbf-fbcc-4dca-8300-b75ec096c541	Medium 4.7	—	Before 7.1.14	`7.1.14`	October 2, 2018

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.