WordPress plugin
REST API TO MiniProgram security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High1
- Medium3
- Low0
All REST API TO MiniProgram vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover ≤4.7.1Update to 4.7.6 | CVE-2024-8485 | |
| High7.5 | Unauthenticated SQL Injection ≤4.7.1Update to 5.1 | CVE-2024-8484 |
- Critical9.8Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover
≤4.7.1Update to 4.7.6
- High7.5Unauthenticated SQL Injection
≤4.7.1Update to 5.1
REST API TO MiniProgram: common questions
Does REST API TO MiniProgram have known vulnerabilities?
Yes. VulnCrest Radar lists 5 known vulnerabilities in REST API TO MiniProgram: 1 critical, 1 high, 3 medium. At least one is not fixed in the latest version.
How do I check which version of REST API TO MiniProgram I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent REST API TO MiniProgram vulnerability?
CVE-2026-3460, published Mar 20, 2026: REST API TO MiniProgram <= 5.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter. Severity: Medium (CVSS 5.3).
Is any REST API TO MiniProgram vulnerability listed in CISA KEV?
No. None of the known REST API TO MiniProgram vulnerabilities is currently listed in the CISA KEV catalog.