WordPress 4.9.6 is an older version still used by 267 websites worldwide, but it contains critical security vulnerabilities that put your site at serious risk. Our security analysis discovered 6 CVEs affecting this version, with one HIGH severity vulnerability that could allow attackers to execute arbitrary code and delete essential files. If your website is running this outdated version, you need to take action immediately to protect your data, visitors, and business reputation.
This comprehensive guide will walk you through identifying if your site uses WordPress 4.9.6, understanding the specific threats you face, and implementing the necessary security fixes. Whether you manage one site or multiple properties, understanding these vulnerabilities is the first step toward protecting your digital assets.
WordPress 4.9.6 was released in July 2018 and represents an older version of the world's most popular website platform. While it may still be functional for basic website needs, security vulnerabilities discovered since its release have made it increasingly dangerous to operate. Think of it like driving a car from 2018 without any safety updates—it might still run, but it's missing critical safety features that protect you from modern threats.
Website owners sometimes avoid upgrading because they worry about breaking plugins, themes, or custom code. However, staying on WordPress 4.9.6 is like leaving your front door unlocked to avoid changing your keys. The security risks far outweigh any temporary compatibility concerns. Modern WordPress versions include patches for thousands of discovered vulnerabilities, and updating is the single most important step you can take to protect your website.
6 CVEs found. The most critical are explained below.
A security weakness allows users with Author-level access to delete your site's most important configuration file (wp-config.php) by exploiting a file handling feature. This happens because WordPress doesn't properly validate which files these users can interact with.
Impact: If exploited, your entire website could become non-functional or completely compromised, as the deleted file contains your database credentials and security keys.
↗ View on NVDThe WP Links Page plugin has a weakness that allows authenticated attackers to manipulate database queries through unsanitized input. This occurs because the plugin doesn't properly filter user-supplied data before using it in database commands.
Impact: Attackers could view, modify, or delete your website's data without authorization, potentially exposing sensitive information or corrupting your content.
↗ View on NVDThe EventON Pro plugin fails to verify user permissions before allowing data modifications. This means users with minimal access (Subscriber level) can make changes they shouldn't be allowed to make.
Impact: Low-level users could modify event settings, pricing, or other important data without proper authorization, causing operational disruptions.
↗ View on NVDThe ShiftController Employee Shift Scheduling plugin doesn't properly clean up information from website URLs before displaying it. Attackers can embed malicious code in links that executes when employees visit them.
Impact: Employees clicking malicious links could have their session hijacked, passwords stolen, or malware installed on their computers.
↗ View on NVDThe Uni CPO WooCommerce plugin doesn't check user permissions before allowing file deletion. Any user, even those with minimal access, could delete important files from your website.
Impact: Product information, pricing data, or other critical files could be deleted without authorization, disrupting your online store operations.
↗ View on NVDThe ChatBot plugin for WordPress doesn't properly validate input in the FAQ Builder feature. Administrators could accidentally or maliciously insert harmful code that gets permanently stored and displayed to all visitors.
Impact: Visitors to your site could have their information stolen, browsers compromised, or be redirected to malicious websites without their knowledge.
↗ View on NVDScan your site in 30 seconds. Used by 500+ web agencies.
WordPress 4.9.6 poses significant security risks that could result in data theft, website defacement, malware infection, or complete loss of functionality. The HIGH severity vulnerability allowing code execution (CVE-2018-12895) alone is reason enough to upgrade immediately. By following this guide and updating your WordPress installation, you eliminate the majority of known threats and protect your business from costly security incidents.
Don't wait until your site is compromised. Visit SiteRecipe.com today to scan your website for outdated software, security vulnerabilities, and potential threats. Our comprehensive security audit will identify exactly what needs attention and provide step-by-step guidance to fix every issue. Protect your website, your visitors, and your business reputation—get your free security scan from SiteRecipe.com now.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.