SolidWP vulnerabilities

Products

• iThemes Sync 1
• Solid Security 1
• Solid Security – Password, Two Factor Authentication, and Brute Force Protection 1

Latest SolidWP CVEs

Newest publication first

1. CVE-2023-40001 WordPress iThemes Sync plugin <= 2.1.13 - Broken Access Control vulnerability

   Published 2024-12-13

   Medium·CVSS 4.3

   Missing Authorization vulnerability in SolidWP iThemes Sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through 2.1.13.

2. CVE-2022-44593 WordPress Solid Security plugin <= 9.3.1 - IP Spoofing Leading to Denial of Service vulnerability

   Published 2024-06-21

   Low·CVSS 3.7

   Use of Less Trusted Source vulnerability in SolidWP Solid Security allows HTTP DoS.This issue affects Solid Security: from n/a through 9.3.1.

3. CVE-2023-28786 WordPress Solid Security Plugin <= 8.1.4 is vulnerable to Open Redirection

   Published 2023-12-29

   Low·CVSS 3.7

   URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection.This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.