WordPress 4.7.5 is an older version released in 2017 that contains 12 known security vulnerabilities, including 7 high-severity issues that could compromise your website. If you're still running this version, your site is at significant risk from hackers who actively exploit these known weaknesses. This guide will help you identify if you're affected and take immediate action to secure your WordPress installation.
The vulnerabilities in WordPress 4.7.5 range from Cross-Site Request Forgery (CSRF) attacks to Server-Side Request Forgery (SSRF) and authentication bypass flaws. These weaknesses could allow attackers to upload malicious files, steal sensitive data, or gain unauthorized admin access. With 109 websites still using this version, it remains a prime target for automated attacks.
WordPress 4.7.5 is a version of WordPress released in April 2017. WordPress is the world's most popular website building platform, powering over 40% of all websites. Think of it as a content management system (CMS)—software that helps you create, edit, and publish content on your website without needing to know how to code. It's designed for bloggers, small businesses, and enterprises alike.
When WordPress releases a new version, it typically includes bug fixes, new features, and most importantly, security patches that close vulnerabilities discovered in older versions. Version 4.7.5 was released over six years ago, and since then, WordPress has released hundreds of updates with critical security improvements. Using an outdated version like 4.7.5 is like leaving your front door unlocked—it's an open invitation to cybercriminals who know exactly how to exploit its weaknesses.
12 CVEs found. The most critical are explained below.
WordPress is missing a security check when you upload files to your server. This means someone could trick you into changing important file settings without your knowledge. They do this by getting you to click a malicious link while you're logged into WordPress.
Impact: An attacker could modify your WordPress installation files, potentially compromising your entire website and the data stored on it.
↗ View on NVDIf you use the Fancy Product Designer plugin, attackers can upload dangerous files to your server without proper permission checks. These files could give hackers complete control over your website.
Impact: Attackers gain full access to your web server, can steal customer data, inject malware, or shut down your website entirely.
↗ View on NVDWordPress has a system called XML-RPC that allows external programs to manage your posts. This system doesn't properly validate the information it receives, which could allow attackers to manipulate your post data.
Impact: Attackers could modify or delete your posts, inject malicious content into your site, or steal sensitive information about your posts.
↗ View on NVDWordPress doesn't properly check where it's redirecting your visitors. An attacker could exploit this to send your users to dangerous websites or make WordPress connect to servers controlled by hackers.
Impact: Your visitors could be sent to malicious sites that steal their information, or attackers could access internal systems through your WordPress installation.
↗ View on NVDThe Jupiter X Core plugin has a serious flaw in its social login feature. Attackers can bypass the login process entirely and gain access as your site administrator without needing a password.
Impact: Hackers gain complete control of your website, can steal all data, modify content, install malware, or lock you out of your own site.
↗ View on NVDThe XML-RPC system in WordPress doesn't properly check permissions before letting external programs access your post information. This means unauthorized users could read or modify your posts.
Impact: Attackers could steal confidential post data, modify published content, or access posts you intended to keep private.
↗ View on NVDShowing first 10 of 6. View all on NVD ↗
| CVE ID | Severity | Score | Published | Description |
|---|---|---|---|---|
| CVE-2022-4972 | HIGH | 7.5 | 2024-10-16 | The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to… |
| CVE-2025-13866 | MEDIUM | 6.4 | 2025-12-12 | The Flow-Flow Social Feed Stream plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flow_flow_social_auth AJAX action… |
| CVE-2017-9061 | MEDIUM | 6.1 | 2017-05-18 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict prese… |
| CVE-2017-9063 | MEDIUM | 6.1 | 2017-05-18 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. |
| CVE-2024-7879 | MEDIUM | 4.8 | 2024-11-06 | The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripti… |
| CVE-2025-12168 | MEDIUM | 4.3 | 2026-01-17 | The Phrase TMS Integration for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_delete_log' AJAX… |
Plain English · Fix recommendations · Instant PDF & HTML download
Scan your site in 30 seconds. Used by 500+ web agencies.
WordPress 4.7.5 is no longer safe to use in 2024. The 12 known vulnerabilities—especially the 7 high-severity flaws—pose a serious threat to your website's security and your visitors' data. Updating to the latest WordPress version is one of the most important steps you can take to protect your online presence. The update process takes just minutes, but the security benefits are invaluable.
Don't wait until your site gets hacked. Use SiteRecipe.com's free website vulnerability scanner to identify all security issues on your WordPress site, track your WordPress version, and get personalized recommendations for staying secure. Our platform helps you monitor your site continuously, alerting you to new threats before attackers can exploit them. Secure your site today—visit SiteRecipe.com and run a free security scan now.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.