WordPress 4.8.5 is an older version that contains 7 known security vulnerabilities, including 2 critical flaws that could compromise your website. If you're still running this version, your site is at significant risk from attackers exploiting SQL injection attacks, unauthorized file access, and data breaches. This guide will help you identify if you're affected and provide step-by-step instructions to protect your WordPress installation.
WordPress 4.8.5 is a legacy version released several years ago that many website owners may still be using, either because they haven't updated or their hosting environment doesn't support newer versions. While WordPress is one of the world's most popular website platforms, older versions lack critical security patches that protect against modern threats. Version 4.8.5 specifically has fallen behind significantly, with multiple plugins distributed through WordPress repositories containing dangerous vulnerabilities.
7 CVEs found. The most critical are explained below.
A hacker can manipulate certain image editing features in the WP Easy Gallery plugin to inject malicious commands directly into your website's database. This happens because the plugin doesn't properly filter user inputs before sending them to the database.
Impact: An attacker could steal sensitive information from your database, modify your website content, create unauthorized admin accounts, or completely compromise your site's integrity.
↗ View on NVDThe Hotel Booking Lite plugin has a critical flaw that allows anyone on the internet, even without a login, to download or delete files stored on your web server. The plugin fails to verify who is making the request or validate which files can be accessed.
Impact: Hackers could steal your entire website, customer data, booking information, and configuration files, or delete critical files to take your site offline completely.
↗ View on NVDSimilar to CVE-2024-8436, this is another way attackers can exploit the WP Easy Gallery plugin to manipulate your database by inserting malicious code through the search functionality. The plugin doesn't properly protect against these time-based database attacks.
Impact: Attackers could extract sensitive data from your database, modify records, or gain unauthorized access to administrative functions.
↗ View on NVDThe Jupiter X Core plugin doesn't properly check user permissions before allowing people to export popup templates. This means anyone visiting your site can download your popup designs and configurations without logging in.
Impact: Your proprietary designs and marketing templates could be stolen and reused by competitors, and sensitive configuration data could be exposed.
↗ View on NVDThe WP Easy Gallery plugin doesn't verify user permissions before allowing access to important settings through hidden AJAX requests. Logged-in users with minimal permissions can access and modify features they shouldn't have access to.
Impact: Malicious users could change gallery settings, add malicious galleries, or escalate their access privileges on your website.
↗ View on NVDThe Jupiter X Core plugin has a permission check flaw that allows even basic subscriber accounts to sync and update library content. These users should have very limited access but can perform administrative library functions instead.
Impact: Low-level users could modify website content libraries, introduce malicious elements, or disrupt website functionality through unauthorized library changes.
↗ View on NVDShowing first 10 of 1. View all on NVD ↗
| CVE ID | Severity | Score | Published | Description |
|---|---|---|---|---|
| CVE-2025-12358 | MEDIUM | 4.3 | 2025-12-03 | The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to mis… |
Plain English · Fix recommendations · Instant PDF & HTML download
Scan your site in 30 seconds. Used by 500+ web agencies.
WordPress 4.8.5 is no longer safe for production websites. The 7 known vulnerabilities—especially the critical SQL injection flaws in WP Easy Gallery and Hotel Booking Lite—leave your site exposed to data theft, file manipulation, and complete compromise. Updating to the latest WordPress version and patching all plugins is not optional; it's essential for protecting your business, customer data, and website reputation. Use SiteRecipe.com's comprehensive WordPress security audit tools to identify vulnerabilities across your entire installation and receive actionable recommendations for securing your site today.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.