Is Wptools safe?

What this plugin does

• Slug: wptools

Maintenance status

Known vulnerabilities

4 known CVEs on file for Wptools. Reported between 2022 and 2025.

CVE-2025-49273

The WP Tools Repair, Javascript errors, Jquery errors, Increase Maximum Limits, File Permissions, Transients, Error Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.24. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.

Source: Wordfence

CVE-2025-39544

The WP Tools plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.18. This is due to missing or incorrect nonce validation on the deactivate_mu_plugin() function. This makes it possible for unauthenticated attackers to rename arbitrary files (which is the equivalent of arbitrary file deletion) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Source: Wordfence

CVE-2022-43453

The WP Tools plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.41. This is due to missing capability check resulting in authorization bypass. This makes it possible for subscriber-level attackers to access unspecified user controls granted at a higher authorization-level.

Source: Wordfence

CVE-2022-3881

The WP Tools plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wptools_install_plugin() function in versions up to, and including, 3.42. This makes it possible for authenticated attackers with minimal permission, such as a subscriber, to install other plugins owned by the developer on the vulnerable site. This could be used to install additional vulnerable plugins that could aid in further compromise of the site.

Source: Wordfence

WP Tools Debug Log, Repair, Javascript errors, Jquery errors, Increase Maximum Limits, File Permissions, Transients, Error Log [wptools] < 3.43 (closed)

Update the WordPress WP Tools plugin to the latest available version (at least 3.43). TomS discovered and reported this Broken Access Control vulnerability in WordPress WP Tools Plugin. This vulnerability has been fixed in version 3.43.

Source: Patchstack

How to fix it

Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.

This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.