Security
Security you can count on
WP Customer Area protects private files and client data. Here is how to report a vulnerability, how fast we respond, and how fixes reach your site.
Report a vulnerability
Found a security issue? Tell us privately.
Email [email protected] with the affected plugin and version, the steps to reproduce, and the impact you observed. Please do not post it in the support forum or disclose it publicly until a fix is released.
You can also use the Patchstack vulnerability disclosure program or the Wordfence vulnerability disclosure program: reports submitted there are verified by their team and sent to us.
Security reports are always handled, whatever your license status. We are happy to credit researchers in the release notes.
Our commitments
How fast we respond
| Severity | Typical case | Target |
|---|---|---|
| Acknowledgement | Every report | Within 48 hours |
| Critical | Exploitable without an account, site takeover, data exposure | Fix within 72 hours |
| High | Exploitable by a logged-in user, privilege escalation | Fix within 7 days |
| Medium and low | Limited impact or hard to exploit | Next release, within 30 days |
Delays start when the report is confirmed. We keep the reporter informed until the fix is released.
Updates
How fixes reach your site
- WP Customer Area (free plugin): fixes are published on wordpress.org and offered to every site through WordPress updates.
- Premium add-ons: fixes are delivered through WordPress updates to sites with an active license.
- Each fix is listed in the changelog and, for security issues, in the table below.
Best practices
Keep your client portal safe
- Keep WordPress, WP Customer Area and its add-ons up to date. Enable automatic updates for them if you can.
- Keep your add-on licenses active so security fixes reach your site.
- Give each user the lowest role they need, and review administrator accounts regularly.
- Use strong passwords, two-factor authentication and a web application firewall.
- Back up your site and your private files on a regular schedule.
Security releases
Fixed vulnerabilities
If your version is older than the one listed, update now.
| Date | Plugin | Fixed in | Issue |
|---|---|---|---|
| WP Customer Area | 8.3.7 | Missing authorization check on a setup wizard action. CVE-2025-49982 | |
| WP Customer Area | 8.3.6 | Stored cross-site scripting (XSS) through a shortcode attribute. CVE-2026-7640 | |
| WP Customer Area | 8.3.5 | Missing privilege and path checks in file and editor image handlers. | |
| WP Customer Area | 8.3.1 | Local file inclusion and path traversal in file downloads. CVE-2025-60201 | |
| Bulk Import | 1.2.0 | Stricter validation of imported files, path traversal protection. |
