WordPress 4.6.4, released in 2016, is an older version still running on 5 websites worldwide. This version contains 6 documented security vulnerabilities, including 3 high-severity flaws that could allow attackers to inject malicious code, escalate privileges, and modify data without authorization. If your website is still using WordPress 4.6.4, you're at significant risk of compromise.
In this comprehensive guide, we'll explain what these vulnerabilities are, how to check if you're affected, and the exact steps to secure your WordPress installation. Whether you're a website owner or administrator, understanding these risks is essential for protecting your site and your visitors' data.
WordPress 4.6.4 is a maintenance release from September 2016 designed to fix bugs and improve stability in the WordPress content management system. At the time of release, it was considered secure, but eight years of security research has since discovered multiple vulnerabilities in plugins commonly used with this version. WordPress 4.6.4 includes the core WordPress software and a default installation, but many site owners extend functionality with third-party plugins.
Think of WordPress like a smartphone operating system—the core system (WordPress 4.6.4) needs to stay updated, but the apps you install (plugins) also need security patches. When either falls behind, your entire system becomes vulnerable. The 6 vulnerabilities in WordPress 4.6.4 primarily affect popular plugins like WP Activity Log, Essential Addons for Elementor, and All-in-One Video Gallery, making this version particularly risky for active websites.
6 CVEs found. The most critical are explained below.
This vulnerability allows attackers to trick administrators into making unwanted changes to A/B testing experiments without their knowledge. The plugin doesn't properly verify that form submissions actually come from authorized users.
Impact: Attackers could modify your A/B testing experiments, potentially directing traffic incorrectly or disrupting your marketing campaigns and data collection.
↗ View on NVDThis is a serious database vulnerability where attackers can inject malicious code into search parameters. The plugin doesn't properly filter what users type into the activity log search feature, allowing hackers to access your entire database.
Impact: An attacker could steal sensitive information like usernames, passwords, and customer data from your WordPress database, or modify/delete critical information.
↗ View on NVDThis plugin allows users with very basic access (like regular subscribers) to create registration forms and assign admin roles without restrictions. Attackers could promote themselves to administrator status.
Impact: A hacker could gain full administrative control of your website, allowing them to steal data, install malware, or take your site offline completely.
↗ View on NVDThe Video Gallery plugin doesn't properly check user permissions before allowing modifications to video content. Unauthorized users could create, view, or delete videos stored in your gallery.
Impact: Users could add malicious content to your video gallery, delete important videos, or access video files they shouldn't be able to see.
↗ View on NVDThe plugin doesn't adequately verify user permissions and exposes security tokens. This allows low-level users (subscribers) to perform actions that should only be available to administrators.
Impact: Basic site users could perform administrative tasks they shouldn't have access to, potentially modifying site settings or accessing sensitive features.
↗ View on NVDThe Video Gallery plugin doesn't check if users have permission before allowing them to modify user profile information. Subscribers could alter their own or other users' data.
Impact: Users could modify account information, escalate their own permissions, or tamper with other users' profiles and metadata.
↗ View on NVDScan your site in 30 seconds. Used by 500+ web agencies.
WordPress 4.6.4 contains serious security vulnerabilities that expose your website to SQL injection attacks, privilege escalation, and unauthorized data modification. The good news is that updating to a modern WordPress version eliminates all these risks and provides access to new features and performance improvements. Every day your site runs outdated software increases the likelihood of successful attacks.
Don't let your website become a target. Use SiteRecipe.com's vulnerability scanner to identify security issues across your entire WordPress installation, including outdated versions and vulnerable plugins. Our platform provides detailed remediation guidance, automated update recommendations, and continuous monitoring to keep your site secure. Start your free security audit today and protect what matters most.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.