PLUGIN SECURITY
Is User Role Editor safe?
User Role Editor WordPress plugin makes user roles and capabilities changing easy. Edit/add/delete WordPress user roles and capabilities.
What this plugin does
- Slug:
user-role-editor - Author: Vladimir Garagulya
- 700000+ active installs
- 90/100 rating (288 reviews on wordpress.org)
- 22269030 all-time downloads
- On WordPress.org since 2010-03-22
accesseditorrolesecurityuser
Maintenance status
- Latest known version: 4.65
- Last updated: 2026-08-25 9:19am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
1 known CVE on file for User Role Editor. Reported between 2013 and 2024.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-12293 | User Role Editor [user-role-editor] < 4.64.4 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 4.64.4 | 4.64.4 | 2024-12-16 | ✓ fixed in latest |
| — | User Role Editor [user-role-editor] < 4.25 | — | Unknown | < 4.25 | 4.25 | 2016-04-05 | ✓ fixed in latest |
| — | User Role Editor [user-role-editor] < 4.25 | — | Unknown | < 4.25 | 4.25 | 2016-04-04 | ✓ fixed in latest |
| — | User Role Editor [user-role-editor] < 3.13 | — | Unknown | < 3.13 | 3.13 | 2013-05-26 | ✓ fixed in latest |
| — | User Role Editor [user-role-editor] < 4.25 | — | Unknown | < 4.25 | 4.25 | — | ✓ fixed in latest |
| — | User Role Editor [user-role-editor] < 3.14 | — | Unknown | < 3.14 | 3.14 | — | ✓ fixed in latest |
| — | User Role Editor - Cross-Site Request Forgery | — | Unknown | < 3.14 | 3.14 | — | ✓ fixed in latest |
| — | User Role Editor <= 4.24 - Privilege Escalation | — | Unknown | < 4.25 | 4.25 | — | ✓ fixed in latest |
How to fix it
Keep User Role Editor updated — 4.65 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Elementor Website Builder – more than just a page builder — 10000000+ active installs — 90/100 (7296)
- Classic Editor — 9000000+ active installs — 98/100 (1246) — max PHP 8.4
- Classic Widgets — 2000000+ active installs — 98/100 (272) — max PHP 8.4
- Loginizer — 1000000+ active installs — 96/100 (1030) — max PHP <8.0
- Advanced Editor Tools — 1000000+ active installs — 90/100 (354) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.