WordPress plugin
WP REST API (WP API) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 3 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium1
- Low0
All WP REST API (WP API) vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.1 | Cross-Site Scripting ≤1.2.2Update to 1.2.3 | — | |
| High7.5 | Sensitive Information Disclosure <1.2.1Update to 1.2.1 | — | |
| High8.8 | Potential Cross-Site Request Forgery Bypass ≤1.1Update to 1.1.1 | — |
- Medium6.1Cross-Site Scripting
≤1.2.2Update to 1.2.3
- High7.5Sensitive Information Disclosure
<1.2.1Update to 1.2.1
- High8.8Potential Cross-Site Request Forgery Bypass
≤1.1Update to 1.1.1
WP REST API (WP API): common questions
Does WP REST API (WP API) have known vulnerabilities?
Yes. VulnCrest Radar lists 3 known vulnerabilities in WP REST API (WP API): 2 high, 1 medium. None are known to affect version null.
How do I check which version of WP REST API (WP API) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP REST API (WP API) vulnerability?
6702c762-14c1-490a-92e4-313b785b3407, published Aug 14, 2015: WP REST API <= 1.2.2 - Cross-Site Scripting. Severity: Medium (CVSS 6.1).
Is any WP REST API (WP API) vulnerability listed in CISA KEV?
No. None of the known WP REST API (WP API) vulnerabilities is currently listed in the CISA KEV catalog.