High
Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update
The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and potentially take over the site.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| WordPress plugin | 404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring | < 3.0.2 | 3.0.2 |
| WordPress plugin | Addendio LITE – Find WordPress plugins and themes | <= 1.2.2 | no fix |
| WordPress plugin | Livemesh Addons by Elementor | < 2.6 | 2.6 |
| WordPress plugin | Add Pinterest conversion tags for Pinterest Ads + Site verification | < 1.0.2 | 1.0.2 |
| WordPress plugin | Ant Admin Notices for Team | < 1.0.4 | 1.0.4 |
| WordPress plugin | Advanced Classifieds & Directory Pro | < 1.6.3 | 1.6.3 |
| WordPress plugin | WordPress Animation Plugin – Animated Everything | <= 1.3.2 | no fix |
| WordPress plugin | Any Popup – Popup Forms, Optins & Ads | <= 1.0 | no fix |
| WordPress plugin | a-staff – Team member showcase plugin for WordPress | <= 1.2.2 | no fix |
| WordPress plugin | Automatic Post Categories | <= 1.0 | no fix |
| WordPress plugin | Before and After Product Images for WooCommerce | <= 1.0.3 | no fix |
| WordPress plugin | Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels | < 2.2.3.1 | 2.2.3.1 |
| WordPress plugin | Better Robots.txt – AI-Ready Crawl Control & Bot Governance | < 1.2.6 | 1.2.6 |
| WordPress plugin | BuddyForms | < 2.3.2 | 2.3.2 |
| WordPress plugin | BuddyForms EasyPin | <= 1.0.1 | no fix |
| WordPress plugin | ClimateClick: Climate Action for all | <= 1.0.9.21 | 1.0.9.22 |
| WordPress plugin | Webheadcoder Multi-Step Forms for Contact Form 7 | < 3.0.9 | 3.0.9 |
| WordPress plugin | Content Aware Sidebars – Fastest Widget Area Plugin | < 3.8.1 | 3.8.1 |
| WordPress plugin | Content Collector | <= 1.1.1 | no fix |
| WordPress plugin | CP Image Gallery | <= 1.0.1 | no fix |
| WordPress plugin | CP Simple Newsletter | <= 1.1 | no fix |
| WordPress plugin | Cryptocurrency Portfolio Tracker | <= 0.0.17 | no fix |
| WordPress plugin | Customer Chat Facebook | <= 1.1.1 | no fix |
| WordPress plugin | Custom Registration and Custom Login Forms with New Recaptcha | <= 1.1 | no fix |
| WordPress plugin | Delete Duplicate Posts | < 4.1.9.5 | 4.1.9.5 |
| WordPress plugin | DeMomentSomTres Address | <= 2.1 | no fix |
| WordPress plugin | DeMomentSomTres Categories | <= 201704251008 | no fix |
| WordPress plugin | DeMomentSomTres Classify on Publish | <= 201703020805 | no fix |
| WordPress plugin | DeMomentSomTres Grid Archive | <= 2.1 | no fix |
| WordPress plugin | DeMomentSomTres Media Tools Auto | <= 2.0 | no fix |
| WordPress plugin | Device Frame | <= 1.0.0 | no fix |
| WordPress plugin | Drop Shadow Boxes | < 1.7.2 | 1.7.2 |
| WordPress plugin | Easy Code Snippets | < 1.0.1 | 1.0.1 |
| WordPress plugin | Easy Watermark | < 0.7.1 | 0.7.1 |
| WordPress plugin | Easy Digital Downloads – Courses | < 0.1.1 | 0.1.1 |
| WordPress plugin | EDD Tab Manager | < 1.3.1 | 1.3.1 |
| WordPress plugin | enhanced-catalog-images-for-woocommerce | <= 1.0.1 | no fix |
| WordPress plugin | Error Log Monitor | < 1.6.5 | 1.6.5 |
| WordPress plugin | Expire tags | <= 1.1 | no fix |
| WordPress plugin | Fast WordPress | <= 1.0.3 | no fix |
| WordPress plugin | FIT: Featured Image Toolkit | <= 1.0.3 | no fix |
| WordPress plugin | Get feedback from visitors – WP Feedback Suite Plugin | <= 1.0.5 | no fix |
| WordPress plugin | Image Photo Gallery Final Tiles Grid | < 3.3.57 | 3.3.57 |
| WordPress plugin | Lightbox & Modal Popup WordPress Plugin – FooBox | < 2.6.4 | 2.6.4 |
| WordPress plugin | FooGallery Photo Gallery : Image, Video & Masonry Galleries | < 1.6.17 | 1.6.17 |
| WordPress plugin | freemage | <= 1.0 | no fix |
| WordPress plugin | WordPress Cloaking – Show & Create Geo-Targeted Custom HTML Plugin – GeoRequest | <= 0.1.9 | no fix |
| WordPress plugin | GFireM Action After | <= 1.1.6 | no fix |
| WordPress plugin | GFireM Advance Search | <= 1.2.2 | no fix |
| WordPress plugin | GFireM Fields | <= 1.1.7 | no fix |
| WordPress plugin | Simple Giveaways – Grow your business, email lists and traffic with contests | < 2.18.0 | 2.18.0 |
| WordPress plugin | Giveaways for woocommerce | <= 1.0.0 | no fix |
| WordPress plugin | Global Income Stats from Freemius | <= 1.0.0 | no fix |
| WordPress plugin | go-fetch-jobs-jobengine | <= 1.0 | no fix |
| WordPress plugin | Gravity Forms Sticky List | <= 1.5.2 | no fix |
| WordPress plugin | Helpie FAQ — Accordion, Docs & Knowledge Base | < 0.7.2 | 0.7.2 |
| WordPress plugin | Import Social Statistics | <= 1.0.2 | no fix |
| WordPress plugin | Inbound Brew | <= 1.9.4 | no fix |
| WordPress plugin | Insert or Embed Articulate Content into WordPress | < 4.2997 | 4.2997 |
| WordPress plugin | Kanzu Support Desk – WordPress Helpdesk Plugin | <= 2.4.7 | no fix |
| WordPress plugin | KRSP Frontend File Uploader | <= 1.0 | no fix |
| WordPress plugin | Livemesh SiteOrigin Widgets | < 2.5.2 | 2.5.2 |
| WordPress plugin | Master Blocks – Gutenberg Site Builder | <= 1.0.4 | no fix |
| WordPress plugin | WP Mobile Menu – The Mobile-Friendly Responsive Menu | < 2.7.3 | 2.7.3 |
| WordPress plugin | Multilist Subscribe for Sendy | <= 1.6.1 | no fix |
| WordPress plugin | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | < 3.1.7 | 3.1.7 |
| WordPress plugin | WooCommerce Next Order Coupon | <= 0.4.0 | no fix |
| WordPress plugin | NEXUS | <= 2.0 | no fix |
| WordPress plugin | Nitek Carousel Slider Cool Transitions | <= 1.1.0 | no fix |
| WordPress plugin | Nugget by Ingot: Easy, automated and native A/B testing for everyone | <= 1.0.0 | no fix |
| WordPress plugin | One Page Blocks | <= 1.0.0 | no fix |
| WordPress plugin | Page Studio Lite Plugin | <= 1.0.6 | no fix |
| WordPress plugin | Past Events Extension | <= 1.0.1 | no fix |
| WordPress plugin | Perelandra Sermons | <= 1.1.0 | no fix |
| WordPress plugin | Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | < 1.8.3 | 1.8.3 |
| WordPress plugin | Post Snippets – Custom WordPress Code Snippets Customizer | < 3.0.6 | 3.0.6 |
| WordPress plugin | Premmerce Product Filter for WooCommerce | < 3.2 | 3.2 |
| WordPress plugin | Premmerce Variation Swatches for WooCommerce | < 1.1 | 1.1 |
| WordPress plugin | Premmerce Wholesale Pricing for WooCommerce | < 1.1.4 | 1.1.4 |
| WordPress plugin | Premmerce Wishlist for WooCommerce | < 1.1.3 | 1.1.3 |
| WordPress plugin | Press Elements – Widgets for Elementor | <= 1.7.2 | no fix |
| WordPress plugin | Price Bands for WooCommerce | <= 1.0.4 | no fix |
| WordPress plugin | Product Tables for WooCommerce: Quickster | <= 1.0.2 | no fix |
| WordPress plugin | Random Sorting Order for WooCommerce | <= 1.0 | no fix |
| WordPress plugin | Contact Form for WordPress- Cybrosys | <= 5.0 | no fix |
| WordPress plugin | Remove WP Update Nags | < 1.4.0 | 1.4.0 |
| WordPress plugin | Online Booking for Barbershops and Salons | <= 1.0.0 | no fix |
| WordPress plugin | Affiliate Link Builder Plugin for Amazon Associates – Review Engine | <= 1.0.41 | no fix |
| WordPress plugin | WordPress Reviews by ReviewPress | <= 1.0.5 | no fix |
| WordPress plugin | Revolution for Elementor | <= 0.0.19 | no fix |
| WordPress plugin | MailChimp Manager | <= 1.0.2 | no fix |
| WordPress plugin | Run time Image resizing | <= 1.1 | no fix |
| WordPress plugin | RW Divi Unite Gallery | <= 1.0 | no fix |
| WordPress plugin | Content Slider for WP Posts (Section Slider) | all versions | no fix |
| WordPress plugin | WP Author Bio | <= 1.5.5 | no fix |
| WordPress plugin | SheetPress – Manage WordPress Meta data with Google Sheets | <= 1.1 | no fix |
| WordPress plugin | SnazzyAdmin WP Admin Theme | <= 1.0.2 | no fix |
| WordPress plugin | Social Gallery Lite | <= 3.1 | no fix |
| WordPress plugin | Sprout Clients – CRM and Lead Management | <= 3.1 | 3.2 |
| WordPress plugin | Starfish Review Generation & Marketing for WordPress | < 2.0.1 | 2.0.1 |
| WordPress plugin | Stop User Enumeration | < 1.3.20 | 1.3.20 |
| WordPress plugin | TinyMCE Annotate | <= 1.1.2 | no fix |
| WordPress plugin | Turbo Widgets | <= 2.0.0 | no fix |
| WordPress plugin | FTC Disclosure | <= 2.0 | no fix |
| WordPress plugin | Social Share Icons & Social Share Buttons | < 3.0.4 | 3.0.4 |
| WordPress plugin | Ultimate Widgets Light | <= 1.5.9.4 | no fix |
| WordPress plugin | Ultimeter – the Ultimate Progress and Goals Meter | < 1.9.3 | 1.9.3 |
| WordPress plugin | BuddyPress Integration for WooCommerce | < 3.2.6.1 | 3.2.6.1 |
| WordPress plugin | Funnelmentals | < 1.2.9 | 1.2.9 |
| WordPress plugin | wGauge – Free Version | <= 1.0.0 | no fix |
| WordPress plugin | Widgets for SiteOrigin | < 1.4.3 | 1.4.3 |
| WordPress plugin | Widgets on Pages and Posts | <= 1.4.0 | no fix |
| WordPress plugin | Woo Admin Product Notes | <= 1.0.0 | no fix |
| WordPress plugin | WooRocks Magic Content | <= 1.0.17 | no fix |
| WordPress plugin | Magic Content for Siteorigins Pagebuilder | <= 1.0.1 | no fix |
| WordPress plugin | WP Advanced Comment | <= 0.3 | no fix |
| WordPress plugin | WP Affiliate Disclosure | < 1.1.4 | 1.1.4 |
| WordPress plugin | wp-buddha-free-adwords | <= 1.0.0 | no fix |
| WordPress plugin | WP fail2ban – Advanced Security | < 4.0.5 | 4.0.5 |
| WordPress plugin | WP Munich Blocks – Gutenberg Blocks for WordPress | < 0.7.3 | 0.7.3 |
| WordPress plugin | WP Photo Effects | < 1.2.3 | 1.2.3 |
| WordPress plugin | WP Private Media | <= 1.0.1 | no fix |
| WordPress plugin | WP Pro Counter | <= 1.1 | no fix |
| WordPress plugin | WP Relevant Ads | <= 1.0.0 | no fix |
| WordPress plugin | WP Activity Log | < 3.3.1.2 | 3.3.1.2 |
| WordPress plugin | BAVOKO SEO Tools – All-in-One WordPress SEO | < 2.1.9.8 | 2.1.9.8 |
| WordPress plugin | XPoster – Share to Bluesky and Mastodon | < 3.3.0 | 3.3.0 |
| WordPress plugin | WordPress FAQ Plugin – WPWorx | <= 2.0.0 | no fix |
| WordPress theme | Bani | <= 1.0.7 | no fix |
| WordPress theme | Brand | <= 1.9.1 | no fix |
| WordPress theme | ConsultPress Lite | <= 1.2.3 | no fix |
| WordPress theme | Purus | <= 1.2.2 | no fix |
| WordPress theme | Shuban | <= 1.1.2 | no fix |
| WordPress theme | Speculor | <= 1.2.0 | no fix |
References
CVSS score
8.8/10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-862- Platform
- WordPress
- Package
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring, Addendio LITE – Find WordPress plugins and themes, Livemesh Addons by Elementor- Disclosed
- 25.02.2019
- Updated
- 11.10.2026 10:22
Sources and licenses
Wordfence Intelligence - 3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0 - Wordfence Intelligence
Copyright 2012-2026 Defiant Inc.
This record contains material that is subject to copyright
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc. Copyright Defiant, Inc. All rights reserved except as granted below. License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026): Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy. Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Vulnerability history: 404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
All published vulnerabilities of this package (WordPress plugin), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 7
- First → latest
- 08.2015 07.2023
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 2
- Medium 4
Disclosures per year
- 2017: 0
- 2018: 0
- 2019: 1
- 2020: 0
- 2021: 2
- 2022: 1
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 0
earlier: 2
-
Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.