NinjaFirewall and Plugin Vulnerabilities Firewall Are Only WordPress Security Plugins That Protected Against Recent Zero Day
Among the common, but inaccurate, security advice you will hear is that WordPress won’t get hacked if you take basic security measures, including keeping plugins up to date. While doing the basics is really important, the reality is that keeping plugins up to date does nothing to stop a zero-day, a vulnerability being exploited before the developer is aware of it. That is an area where a security plugin could provide additional protection. But just because they could, it doesn’t mean they will. More problematically, WordPress security plugin developers have for years claimed to provide zero-day protection when they don’t. The solution is to do testing to see which plugins really provide protection against zero-days.
Recently, a zero-day role change vulnerability in the 200,000+ install WordPress plugin Ultimate Member was spotted being exploited by the web host Tiger Technologies. That vulnerability was being exploited to create a new WordPress user and then change the user’s role to Administrator, which gives them full access to the website.
As part of reviewing that vulnerability, we tested to make sure the protection for that type of vulnerability in our Plugin Vulnerabilities Firewall plugin worked correctly. It did. So what about competing plugins? Yesterday, we tested 31 of those to see if they also protected against this. Only one, NinjaFirewall, provided protection. That is a rather poor result considering that NinjaFirewall is much less popular than plenty of the other plugins tested. Like our plugin, NinjaFirewall provided protection that didn’t rely on a rule written for the vulnerability, so a future zero-day would also be protected against by the plugin.
Making that result even worse, it isn’t like WordPress security plugins developers shouldn’t be aware that protection against that type of vulnerability is possible, as we did a previous test against this type of vulnerability in another plugin in August 2021.
Testing Procedure
For each of the tested plugins, we set up an install of WordPress 6.2.2, installed version 2.6.3 of Ultimate Member, and installed the latest version of the security plugin. We tried to enable any feature of the plugin that could possibly have an impact on stopping exploitation of the vulnerability. We didn’t set up any additional service connected with the plugins.
We try exploitation with the WordPress data prefix set to the default wp_, which would allow poorly developed security to still provide protection.
The 32 plugins we tested include the security plugins listed in the Popular plugins section of the Plugin Directory and some others that look to be intended or marketed to prevent this type of situation. If you would like to see an additional plugin included in future testing, please leave a comment on the post or contact us.
The full results are below:
All-In-One Security (AIOS)
- WordPress.org Plugin Directory page
- Active Installs: 1+ Million
- Version Tested: 5.1.9
Result: Failed to prevent exploitation.
Anti-Malware Security and Brute-Force Firewall
- WordPress.org Plugin Directory page
- Active Installs: 200,000+
- Version Tested: 4.21.92
Result: Failed to prevent exploitation.
AntiHacker
- WordPress.org Plugin Directory page
- Active Installs: 1,000+
- Version Tested: 4.28
Result: Failed to prevent exploitation.
BBQ Firewall
- WordPress.org Plugin Directory page
- Active Installs: 100,000+
- Version Tested: 20230303
Result: Failed to prevent exploitation.
Bitfire
- WordPress.org Plugin Directory page
- Active Installs: 70+
- Version Tested: 3.9.13
Result: Failed to prevent exploitation.
BulletProof Security
- WordPress.org Plugin Directory page
- Active Installs: 40,000+
- Version Tested: 6.8
Result: Failed to prevent exploitation.
Clearfy
- WordPress.org Plugin Directory page
- Active Installs: 90,000+
- Version Tested: 2.1.9
Result: Failed to prevent exploitation.
Defender
- WordPress.org Plugin Directory page
- Active Installs: 80,000+
- Version Tested: 3.12.0
Result: Failed to prevent exploitation.
Hide My WP
- Code Canyon page
- Active Installs: N/A
- Version Tested: 6.2.9
Result: Failed to prevent exploitation.
Hide My WP Ghost Lite
- WordPress.org Plugin Directory page
- Active Installs: 200,000+
- Version Tested: 5.0.23
Result: Failed to prevent exploitation.
iThemes Security
- WordPress.org Plugin Directory page
- Active Installs: 900,000+
- Version Tested: 8.1.6
Result: Failed to prevent exploitation.
Jetpack
- WordPress.org Plugin Directory page
- Active Installs: 5+ Million
- Version Tested: 12.2.1
Result: Failed to prevent exploitation.
Jetpack Protect
- WordPress.org Plugin Directory page
- Active Installs: 100,000+
- Version Tested: 1.4.0
Result: Failed to prevent exploitation.
MalCare Security
- WordPress.org Plugin Directory page
- Active Installs: 300,000+
- Version Tested: 5.09
Result: Failed to prevent exploitation.
NinjaFirewall
- WordPress.org Plugin Directory page
- Active Installs: 100,000+
- Version Tested: 4.5.8
Result: Prevented exploitation.
Pareto Security
- WordPress.org Plugin Directory page
- Active Installs: 400+
- Version Tested: 3.2.7
Result: Failed to prevent exploitation.
Patchstack
- WordPress.org Plugin Directory page
- Active Installs: 10,000+
- Version Tested: 2.1.25
Result: Failed to prevent exploitation.
Plugin Vulnerabilities Firewall
- Page on our website
- Active Installs: N/A
- Version Tested: 1.0.22
Result: Prevented exploitation.
RSFirewall!
- WordPress.org Plugin Directory page
- Active Installs: 3,000+
- Version Tested: 1.1.26
Result: Failed to prevent exploitation.
SecuPress Free
- WordPress.org Plugin Directory page
- Active Installs: 40,000+
- Version Tested: 2.2.4.1
Result: Failed to prevent exploitation.
Security by CleanTalk
- WordPress.org Plugin Directory page
- Active Installs: 20,000+
- Version Tested: 2.112
Result: Failed to prevent exploitation.
Security Ninja
- WordPress.org Plugin Directory page
- Active Installs: 10,000+
- Version Tested: 5.158
Result: Failed to prevent exploitation.
Shield Security
- WordPress.org Plugin Directory page
- Active Installs: 50,000+
- Version Tested: 18.1.2
Result: Failed to prevent exploitation.
SiteGround Security
- WordPress.org Plugin Directory page
- Active Installs: 900,000+
- Version Tested: 1.4.5
Result: Failed to prevent exploitation.
SiteGuard WP Plugin
- WordPress.org Plugin Directory page
- Active Installs: 500,000+
- Version Tested: 1.7.5
Result: Failed to prevent exploitation.
Sucuri Security
- WordPress.org Plugin Directory page
- Active Installs: 900,000+
- Version Tested: 1.8.39
Result: Failed to prevent exploitation.
Titan Anti-spam & Security
- WordPress.org Plugin Directory page
- Active Installs: 100,000+
- Version Tested: 7.3.5
Result: Failed to prevent exploitation.
Web Application Firewall
- WordPress.org Plugin Directory page
- Active Installs: 300+
- Version Tested: 2.1.1
Result: Failed to prevent exploitation.
Wordfence Security
- WordPress.org Plugin Directory page
- Active Installs: 4+ Million
- Version Tested: 7.10.0
Result: Failed to prevent exploitation.
WP Cerber Security, Anti-spam & Malware Scan
- WordPress.org Plugin Directory page
- Active Installs: 200,000+
- Version Tested: 9.2.2
Result: Failed to prevent exploitation.
WP Hardening
- WordPress.org Plugin Directory page
- Active Installs: 10,000+
- Version Tested: 1.2.6
Result: Failed to prevent exploitation.
WP Hide & Security Enhancer
- WordPress.org Plugin Directory page
- Active Installs: 80,000+
- Version Tested: 2.1
Result: Failed to prevent exploitation.
Plugin Security Scorecard Grade for All-In-One Security (AIOS)
Checked on November 19, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for BBQ Firewall
Checked on March 20, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for BulletProof Security
Checked on November 19, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Clearfy
Checked on August 20, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Defender
Checked on November 20, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Jetpack
Checked on November 24, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for MalCare Security
Checked on November 7, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for NinjaFirewall
Checked on April 1, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Patchstack
Checked on March 5, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Security Ninja
Checked on April 1, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Shield Security
Checked on January 19, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Sucuri Security
Checked on November 12, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Titan Anti-spam & Security
Checked on August 1, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Ultimate Member
Checked on November 23, 2024See issues causing the plugin to get less than A+ grade