WP Engine vulnerabilities

Products

• Advanced Custom Fields 2
• Advanced Custom Fields Pro 2
• Advanced Custom Fields (ACF) 1
• Faust.js 1
• PHP Compatibility Checker 1
• WP Migrate Lite 1

Latest WP Engine CVEs

Newest publication first

1. CVE-2026-49043 WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2026-06-15

   Medium·CVSS 4.7

   Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.

2. CVE-2026-49062 WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability

   Published 2026-06-15

   High·CVSS 8.8

   Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7.

3. CVE-2022-40696 WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure

   Published 2024-01-08

   Low·CVSS 3.7

   Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.

4. CVE-2023-40068 Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitra...

   Published 2023-08-21

   Unknown

   Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with t...

5. CVE-2023-24421 WordPress PHP Compatibility Checker Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-07-11

   Medium·CVSS 5.4

   Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions.

6. CVE-2023-30777 WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)

   Published 2023-05-10

   High·CVSS 7.1

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.