WordPress 4.7.4, released in 2017, is still running on approximately 49 websites worldwide. However, this aging version contains 6 known security vulnerabilities that put your site at serious risk. One high-severity flaw and five medium-severity issues have been discovered, ranging from SQL injection attacks to cross-site scripting (XSS) vulnerabilities.
If you're still using WordPress 4.7.4, your website could be exploited by attackers who can reset passwords, inject malicious code, or steal sensitive information. The good news? These vulnerabilities are well-documented and entirely preventable with proper action. This guide will walk you through identifying whether your site is affected and exactly how to secure it.
Don't let outdated software become your biggest security liability. Understanding these vulnerabilities is the first step toward protecting your WordPress installation and your visitors' data.
WordPress 4.7.4 is a version of WordPress released in April 2017, nearly seven years ago. WordPress is the most popular website builder globally, powering over 43% of all websites on the internet. It's an open-source platform that allows anyone to create blogs, business websites, and online stores without requiring advanced coding knowledge. WordPress 4.7.4 introduced several features and improvements, but like all software, it eventually becomes outdated as new security threats emerge.
Think of WordPress like a house: newer versions are like upgrading your locks and security systems. WordPress 4.7.4 was state-of-the-art when released, but technology and hacking methods have evolved significantly since then. Running an outdated version is comparable to leaving your front door with an old lock that thieves now know how to pick. While many websites still operate on older versions due to compatibility concerns or oversight, doing so exposes them to preventable security risks. Security updates in newer WordPress versions specifically patch vulnerabilities discovered in older releases.
6 CVEs found. The most critical are explained below.
An admin user could inject malicious database commands through the Fancy Product Designer plugin. This happens because the plugin doesn't properly validate input before sending it to your database.
Impact: An attacker with admin access could steal sensitive customer data, modify pricing, or corrupt your database. This requires admin-level access, limiting the risk.
↗ View on NVDWordPress relies on email headers that attackers can fake to intercept or redirect password reset emails. An attacker could trick the system into sending reset links to the wrong place.
Impact: Attackers could reset passwords for any account, including yours, and gain unauthorized access to your website. This is a serious threat if not patched.
↗ View on NVDThe Molongui author plugin has a flaw that lets anyone view sensitive hidden data without logging in. Attackers can request special parameters to extract private information.
Impact: Your site could leak confidential author data, email addresses, or other private information that you didn't intend to share publicly.
↗ View on NVDThe WP ULike plugin doesn't properly filter settings, allowing administrators to inject harmful code. This could affect your website's appearance or functionality.
Impact: An admin account could be compromised or misused to inject malicious scripts that harm visitors or steal their data. Requires admin-level access.
↗ View on NVDThe AI Infographic Maker plugin doesn't check user permissions properly on certain functions. Even basic users could potentially modify content they shouldn't access.
Impact: Subscribers or low-level users could generate or modify AI content without authorization, potentially creating spam or inappropriate material on your site.
↗ View on NVDThe WP ULike plugin is missing security checks (called 'nonce validation') that prevent fake requests. Attackers can trick users into performing unwanted actions.
Impact: Visitors could unknowingly delete their history or have their interactions modified without permission. This could affect user experience and trust.
↗ View on NVDScan your site in 30 seconds. Used by 500+ web agencies.
WordPress 4.7.4 contains six documented security vulnerabilities that could allow attackers to inject malicious code, steal data, or compromise your website's integrity. The high-severity SQL injection flaw in the Fancy Product Designer plugin and multiple XSS vulnerabilities demonstrate why running outdated software is dangerous. Fortunately, updating to a current WordPress version and patching vulnerable plugins eliminates these risks entirely.
Don't leave your website exposed to known security threats. Use SiteRecipe.com's comprehensive vulnerability scanner to identify which CVEs affect your site right now, then follow our step-by-step guide to secure your WordPress installation. Your visitors trust you with their data—make sure you're protecting it with the latest security patches. Start your free security scan at SiteRecipe.com today and take control of your website's safety.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.