WordPress 4.8.6, released in 2017, is an outdated version still running on 18 websites worldwide. While older versions may seem harmless, this particular release contains 4 documented security vulnerabilities that can expose your site to serious attacks. These flaws range from Local File Inclusion (LFI) to Cross-Site Scripting (XSS), putting your website data and visitor information at risk.
If you're still using WordPress 4.8.6, your site could be vulnerable to attackers who exploit these known security holes. The good news? These issues are completely preventable with the right steps. This guide walks you through identifying if you're affected and implementing proper fixes to secure your WordPress installation.
WordPress 4.8.6 is an older version of WordPress, the popular website building platform used by millions globally. Released in 2017, it's been succeeded by dozens of newer versions with improved features and security patches. Many websites still run older WordPress versions because updates can sometimes be delayed or forgotten, especially on smaller or abandoned sites.
Think of WordPress versions like software updates on your phone—each new version fixes bugs and closes security holes discovered in previous versions. Running WordPress 4.8.6 means you're missing years of security improvements and protection against modern threats. This outdated version is particularly risky because hackers know exactly which vulnerabilities exist and actively scan the internet for websites still using it.
4 CVEs found. The most critical are explained below.
A security weakness in the WP Maps plugin (versions up to 4.8.6) allows people with basic user accounts to view files on your server that they shouldn't access. This is like leaving a side door unlocked that anyone with a visitor pass could open.
Impact: Attackers could read sensitive files like configuration files containing database passwords, API keys, or other private information stored on your server.
↗ View on NVDThe WP Maps plugin has a vulnerability that allows attackers to manipulate how the plugin processes data, potentially corrupting your site's functionality. Think of it as someone being able to reprogram how your plugin behaves.
Impact: An attacker could inject malicious code or cause unexpected behavior in your map features, potentially affecting your website's performance or data integrity.
↗ View on NVDThe MC4WP email marketing plugin (version 4.8.6 and earlier) allows administrators to accidentally inject malicious code into your website. An admin account with bad intentions could insert harmful scripts.
Impact: Malicious code could be stored on your site and executed, potentially stealing visitor information, redirecting users, or spreading malware to your audience.
↗ View on NVDThe ChatBot plugin's FAQ builder feature (versions 4.8.6-4.9.6) doesn't properly filter what administrators type in, allowing them to inject malicious code into your website. This requires someone with admin access to do it intentionally.
Impact: If a compromised admin account is used, harmful code could be injected into your FAQ section and executed on your website, affecting visitors.
↗ View on NVDScan your site in 30 seconds. Used by 500+ web agencies.
WordPress 4.8.6 poses serious security risks with its 4 known vulnerabilities affecting file access, data handling, and site content. The stakes are high—these vulnerabilities can lead to data theft, malware injection, and complete website compromise. Fortunately, updating to the latest WordPress version eliminates these risks entirely and provides years of additional security improvements.
Don't leave your website exposed to known attacks. Use SiteRecipe.com's comprehensive security scanning tool to identify vulnerabilities across your entire WordPress installation, get step-by-step remediation guidance, and continuously monitor for new threats. Our platform makes it easy to understand technical security issues in plain language and fix them quickly. Start your free security scan today and protect your website from the vulnerabilities affecting WordPress 4.8.6.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.