wpengine
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Advanced Custom Fields (ACF®) | 3 | – | May 31, 2026 |
| Database Backup for WordPress | 3 | – | May 14, 2026 |
| Better Search Replace | 1 | – | Feb 5, 2024 |
| faustjs | 1 | – | Sep 17, 2026 |
| Gutenberg Blocks – ACF Blocks Suite | 1 | – | Oct 16, 2024 |
| WP Migrate Lite – Migration Made Easy | 1 | – | Nov 18, 2025 |
Exploited and recent CVEs
- CVE-2026-54239 FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope 0.3%
- CVE-2026-8382 Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters 0.5%
- CVE-2026-4029 Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export 0.4%
- CVE-2026-4030 Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion 0.5%
- CVE-2026-4031 Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception 0.5%
- CVE-2026-4812 Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters 0.9%
- CVE-2025-11427 WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery 0.5%
- CVE-2022-4974 Freemius SDK <= 2.4.2 - Missing Authorization Checks 0.4%
- CVE-2023-6701 Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field 0.5%
- CVE-2023-6933 Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection 68.0%