WordPress 4.8.7 contains 5 significant security vulnerabilities that could put your website at risk. While no critical-level flaws have been discovered, one high-severity vulnerability affecting the Jupiter X Core plugin allows authenticated attackers to execute remote code on your site. This version is currently running on 32 websites, making it a prime target for hackers looking to exploit outdated installations.
If you're still using WordPress 4.8.7, you need to take immediate action to protect your site. The vulnerabilities range from Local File Inclusion to Remote Code Execution, Directory Traversal, and multiple Cross-Site Scripting (XSS) attacks through popular plugins. This guide will help you identify whether your site is vulnerable and walk you through the essential steps to secure it.
Understanding these threats is the first step toward protecting your website. Even if you're not a technical expert, following our straightforward recommendations will significantly reduce your risk of being compromised.
WordPress 4.8.7 is an older version of WordPress, the world's most popular website creation platform. Released several years ago, this version allowed millions of website owners to build and manage their sites without needing advanced coding knowledge. However, like all software, WordPress 4.8.7 was eventually superseded by newer versions that include better security features and performance improvements.
This version becomes problematic when combined with certain plugins that have their own security flaws. While WordPress core itself may be relatively stable, vulnerable plugins like Jupiter X Core, EAN for WooCommerce, and WP Maps can create dangerous entry points for attackers. When plugins aren't updated alongside your WordPress installation, these security gaps can be exploited to steal data, inject malicious code, or take complete control of your website.
5 CVEs found. The most critical are explained below.
A dangerous flaw in the Jupiter X Core plugin allows people with editor or contributor access to your site to upload and run harmful code. This is like giving someone the keys to your website's engine room. If a disgruntled employee or hacked account gains this access, they can take complete control of your site.
Impact: An attacker could steal all your data, modify your website content, install malware, or use your site to attack visitors. Your business reputation and customer trust could be severely damaged.
↗ View on NVDAnother flaw in Jupiter X Core lets contributors peek at files they shouldn't access, like configuration files containing database passwords and API keys. Think of it as someone finding a way to read locked filing cabinets in your office.
Impact: Attackers could discover sensitive information needed to break into your website more deeply, compromise customer data, or access your hosting account credentials.
↗ View on NVDThe EAN for WooCommerce plugin has a flaw where malicious code can be permanently stored on your site through product data. When customers view these products, the code runs in their browsers, potentially stealing their information.
Impact: Customers could have their personal or payment information stolen, your site could be blacklisted by search engines, and you could face legal liability for security breaches.
↗ View on NVDThe WP Maps plugin doesn't properly filter data in map shortcodes, allowing attackers to inject malicious code that gets permanently stored and executed. This affects any visitor viewing those maps.
Impact: Visitors' browsers could be compromised, personal data could be stolen, and your site's credibility would be damaged if malware is detected.
↗ View on NVDThe miniOrange single sign-on plugin has a vulnerability in how it processes login information from external sources. Attackers can craft fake login requests that inject malicious code into the login process.
Impact: User accounts could be compromised, login credentials could be stolen, or your site could be used to spread malware to users trying to log in.
↗ View on NVDScan your site in 30 seconds. Used by 500+ web agencies.
WordPress 4.8.7 is outdated and poses genuine security risks to your website. The combination of one high-severity vulnerability and four medium-level flaws—particularly those involving Remote Code Execution and Cross-Site Scripting—means your site could be compromised by attackers. The good news is that updating WordPress and your plugins is a straightforward process that takes just minutes and immediately closes these security gaps.
Don't wait until your site is hacked to take action. Use SiteRecipe.com's comprehensive security scanning tool to identify vulnerabilities across your entire WordPress installation, check plugin compatibility, and receive personalized recommendations for securing your site. Our platform makes it easy to monitor your WordPress health continuously, ensuring you stay protected against emerging threats. Start your free scan today and take control of your website's security.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.