WordPress plugin
Protect WP Admin security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 4 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium3
- Low0
All Protect WP Admin vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Missing Authorization ≤4.1Update to 4.2 | CVE-2025-64249 | |
| Medium5.3 | Unauthenticated Information Disclosure to Protection Bypass ≤3.8Update to 4.0 | CVE-2023-3139 | |
| Medium6.1 | Cross-Site Scripting ≤3.7Update to 3.8 | — | |
| High7.5 | Unauthenticated Plugin Deactivation ≤3.6Update to 3.7 | CVE-2021-24906 |
- Medium5.3Missing Authorization
≤4.1Update to 4.2
- Medium5.3Unauthenticated Information Disclosure to Protection Bypass
≤3.8Update to 4.0
- Medium6.1Cross-Site Scripting
≤3.7Update to 3.8
- High7.5Unauthenticated Plugin Deactivation
≤3.6Update to 3.7
Protect WP Admin: common questions
Does Protect WP Admin have known vulnerabilities?
Yes. VulnCrest Radar lists 4 known vulnerabilities in Protect WP Admin: 1 high, 3 medium. None are known to affect version null.
How do I check which version of Protect WP Admin I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Protect WP Admin vulnerability?
CVE-2025-64249, published Dec 15, 2025: Protect WP Admin <= 4.1 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any Protect WP Admin vulnerability listed in CISA KEV?
No. None of the known Protect WP Admin vulnerabilities is currently listed in the CISA KEV catalog.