PLUGIN SECURITY
Is Wp Simple Firewall safe?
Smart WordPress security that blocks bots automatically, guides you to what matters, and repairs problems — without drowning you in noise.
What this plugin does
- Slug:
wp-simple-firewall - Author: Paul
- 30000+ active installs
- 96/100 rating (1038 reviews on wordpress.org)
- 12789279 all-time downloads
- On WordPress.org since 2013-07-09
2FAActivity Logbotsfirewallsecurity
Maintenance status
- Latest known version: 22.1.3
- Last updated: 2026-08-27 11:36am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
Known vulnerabilities
9 known CVEs on file for Wp Simple Firewall.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-14427 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 21.0.10 | Missing Authorization | Medium 4.3 | < 21.0.10 | 21.0.10 | 2026-02-18 | ✓ fixed in latest |
| CVE-2025-15370 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 21.0.10 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 21.0.10 | 21.0.10 | 2026-01-15 | ✓ fixed in latest |
| CVE-2024-7313 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 20.0.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 20.0.6 | 20.0.6 | 2024-08-05 | ✓ fixed in latest |
| CVE-2024-4344 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 19.1.11 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 19.1.11 | 19.1.11 | 2024-06-01 | ✓ fixed in latest |
| CVE-2023-6989 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 18.5.10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Critical 9.8 | < 18.5.10 | 18.5.10 | 2024-02-05 | ✓ fixed in latest |
| CVE-2024-22163 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 18.5.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 18.5.8 | 18.5.8 | 2024-01-16 | ✓ fixed in latest |
| CVE-2023-0992 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 17.0.18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 17.0.18 | 17.0.18 | 2023-04-25 | ✓ fixed in latest |
| CVE-2023-0993 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 17.0.18 | Missing Authorization | Medium 4.3 | < 17.0.18 | 17.0.18 | 2023-04-25 | ✓ fixed in latest |
+ 3 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2022-0211 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 13.0.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 13.0.6 | 13.0.6 | 2022-01-19 | ✓ fixed in latest |
| — | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 21.0.10 | — | Unknown | < 21.0.10 | 21.0.10 | 0000-00-00 | ✓ fixed in latest |
| — | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall] < 21.0.10 | — | Unknown | < 21.0.10 | 21.0.10 | 0000-00-00 | ✓ fixed in latest |
How to fix it
Keep Wp Simple Firewall updated — 22.1.3 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Wordfence Security – Firewall, Malware Scan, and Login Security — 5000000+ active installs — 94/100 (4983) — max PHP 8.4
- Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) — 3000000+ active installs — 98/100 (8862) — max PHP 8.4
- Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention — 1000000+ active installs — 96/100 (1477) — max PHP 8.4
- WP Activity Log — 300000+ active installs — 94/100 (488)
- Activity Log – Monitor & Record User Changes — 200000+ active installs — 86/100 (74)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.