The WP Hide & Security Enhancer plugin for WordPress is vulnerable to arbitrary file contents deletion due to a missing authorization and insufficient file path validation in the file-process.php in all versions up to, and including, 2.5.1. This makes it possible for unauthenticated attackers to delete the contents of arbitrary files on the server, which can break the site or lead to data loss.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Wp Hide Security Enhancer Plugin | — | Update wp-hide-security-enhancer plugin to version 2.5.2, or a newer patched version | May 15, 2025 | Dec 5, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub