Only Six WordPress Security Plugins Protected Against Exploitation of Zero-Day Vulnerability in BackupBuddy
Last week the developer of one of the most popular WordPress security plugins, iThemes Security, disclosed that another of their plugins, BackupBuddy, had recently had a zero-day vulnerability. That is a vulnerability being exploited by a hacker before the developer is aware of it. One of the implications of that is that keeping a website’s plugins up to date won’t always protect websites from being hacked through vulnerabilities in them. So this is the type of situation where a security plugin, like iThemes Security, could provide protection beyond keeping plugins up to date. If any security plugins should be able to do that, it should be iThemes Security if you believe their marketing, as they claim it is the best:
The Best WordPress Security Plugin to Secure & Protect WordPress
We had a hacker try to exploit this vulnerability on one of our websites (despite our not using the plugin) to try to view the contents of WordPress’ configuration file, so we had the information to see if security plugins would protect against a real hacking attempt. We tested out 31 security plugins and the results were not good.
Three security plugins with a million or more installs failed to provide protection. Those plugins were All In One WP Security & Firewall, iThemes, and Automattic’s Jetpack. As we noted in a previous post, the vulnerability could have easily been avoided, so iThemes not only failed to secure their own code when they should have, but their security plugin didn’t protect against the threat they caused. Despite that, they didn’t apologize for the situation.
Among the plugins that provided protection, was one with only 200+ installs, which is a reminder that the popularity of security plugins doesn’t correlate with the protection they provide. That is why those looking for a security plugin should instead look for evidence that the plugin provides real protection, from testing like this. Notably, we are the only provider that does that kind of testing, so unsurprisingly our Plugin Vulnerabilities Firewall provided protection against this.
The six plugins that provided protection were:
- BBQ Firewall
- NinjaFirewall
- Plugin Vulnerabilities Firewall
- SecuPress Free
- Web Application Firewall
- Wordfence Security
Testing Procedure
For each of the tested plugins, we set up an install of WordPress 6.0.2, installed version 8.7.4.1 of BackupBuddy, and installed the latest version of the security plugin. We tried to enable any feature of the plugin that could possibly have an impact on stopping the exploitation of the vulnerability. We didn’t set up any additional service connected with the plugins.
We used this exploit attempt we saw on our website, which tries to download the WordPress configuration file:
/wp-admin/admin-post.php?local-download=wp-config.php&local-destination-id=0
The 31 plugins we tested include the security plugins listed in the Popular plugins section of the Plugin Directory and some others that look to be intended or marketed to prevent this type of situation. If you would like to see an additional plugin included in future testing, please leave a comment on the post or contact us.
Results
Six plugins provided protection against the proof of concept: BBQ Firewall, NinjaFirewall, Plugin Vulnerabilities Firewall, SecuPress Free, Web Application Firewall, and Wordfence Security
The full results are below:
All In One WP Security & Firewall
- WordPress.org Plugin Directory page
- Active Installs: 1+ Million
- Version Tested: 5.0.7
Result: Failed to prevent exploitation.
Anti-Malware Security and Brute-Force Firewall
- WordPress.org Plugin Directory page
- Active Installs: 200,000+
- Version Tested: 4.21.84
Result: Failed to prevent exploitation.
AntiHacker
- WordPress.org Plugin Directory page
- Active Installs: 1,000+
- Version Tested: 4.19
Result: Failed to prevent exploitation.
BBQ Firewall
- WordPress.org Plugin Directory page
- Active Installs: 100,000+
- Version Tested: 20220517
Result: Prevented exploitation.
BulletProof Security
- WordPress.org Plugin Directory page
- Active Installs: 40,000+
- Version Tested: 6.5
Result: Failed to prevent exploitation.
Clearfy
- WordPress.org Plugin Directory page
- Active Installs: 100,000+
- Version Tested: 2.0.5
Result: Failed to prevent exploitation.
Defender
- WordPress.org Plugin Directory page
- Active Installs: 70,000+
- Version Tested: 3.2.0
Result: Failed to prevent exploitation.
Hide My WP
- Code Canyon page
- Active Installs: N/A
- Version Tested: 6.2.6
Result: Failed to prevent exploitation.
Hide My WP Ghost Lite
- WordPress.org Plugin Directory page
- Active Installs: 200,000+
- Version Tested: 5.0.15
Result: Failed to prevent exploitation.
iThemes Security
- WordPress.org Plugin Directory page
- Active Installs: 1+ Million
- Version Tested: 8.1.2
Result: Failed to prevent exploitation.
Jetpack
- WordPress.org Plugin Directory page
- Active Installs: 5+ Million
- Version Tested: 11.3.1
Result: Failed to prevent exploitation.
Jetpack Protect
- WordPress.org Plugin Directory page
- Active Installs: 5,000+
- Version Tested: 1.0.4
Result: Failed to prevent exploitation.
MalCare Security
- WordPress.org Plugin Directory page
- Active Installs: 200,000+
- Version Tested: 4.82
Result: Failed to prevent exploitation.
NinjaFirewall
- WordPress.org Plugin Directory page
- Active Installs: 80,000+
- Version Tested: 4.5.4
Result: Prevented exploitation.
Pareto Security
- WordPress.org Plugin Directory page
- Active Installs: 500+
- Version Tested: 3.2.0
Result: Failed to prevent exploitation.
Patchstack
- WordPress.org Plugin Directory page
- Active Installs: 7,000+
- Version Tested: 2.1.21
Result: Failed to prevent exploitation.
Plugin Vulnerabilities Firewall
- Page on our website
- Active Installs: N/A
- Version Tested: 1.0.6
Result: Prevented exploitation.
RSFirewall!
- WordPress.org Plugin Directory page
- Active Installs: 2,000+
- Version Tested: 1.1.26
Result: Failed to prevent exploitation.
SecuPress Free
- WordPress.org Plugin Directory page
- Active Installs: 30,000+
- Version Tested: 2.2.2
Result: Prevented exploitation.
Security by CleanTalk
- WordPress.org Plugin Directory page
- Active Installs: 10,000+
- Version Tested: 2.93
Result: Failed to prevent exploitation.
Security Ninja
- WordPress.org Plugin Directory page
- Active Installs: 9,000+
- Version Tested: 5.147
Result: Failed to prevent exploitation.
Shield Security
- WordPress.org Plugin Directory page
- Active Installs: 60,000+
- Version Tested: 16.1.2
Result: Failed to prevent exploitation.
SiteGround Security
- WordPress.org Plugin Directory page
- Active Installs: 600,000+
- Version Tested: 1.3.0
Result: Failed to prevent exploitation.
SiteGuard WP Plugin
- WordPress.org Plugin Directory page
- Active Installs: 500,000+
- Version Tested: 1.6.1
Result: Failed to prevent exploitation.
Sucuri Security
- WordPress.org Plugin Directory page
- Active Installs: 800,000+
- Version Tested: 1.8.35
Result: Failed to prevent exploitation.
Titan Anti-spam & Security
- WordPress.org Plugin Directory page
- Active Installs: 100,000+
- Version Tested: 7.3.1
Result: Failed to prevent exploitation.
Web Application Firewall
- WordPress.org Plugin Directory page
- Active Installs: 200+
- Version Tested: 2.1.1
Result: Prevented exploitation.
Wordfence Security
- WordPress.org Plugin Directory page
- Active Installs: 4+ Million
- Version Tested: 7.6.1
Result: Prevented exploitation.
WP Cerber Security, Anti-spam & Malware Scan
- WordPress.org Plugin Directory page
- Active Installs: 200,000+
- Version Tested: 9.2
Result: Failed to prevent exploitation.
WP Hardening
- WordPress.org Plugin Directory page
- Active Installs: 10,000+
- Version Tested: 1.2.5
Result: Failed to prevent exploitation.
WP Hide & Security Enhancer
- WordPress.org Plugin Directory page
- Active Installs: 80,000+
- Version Tested: 1.8.1
Result: Failed to prevent exploitation.
Plugin Security Scorecard Grade for BBQ Firewall
Checked on June 17, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for BulletProof Security
Checked on June 12, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Clearfy
Checked on August 20, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Defender
Checked on November 20, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Jetpack
Checked on November 24, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for MalCare Security
Checked on November 7, 2024See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for NinjaFirewall
Checked on June 12, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Patchstack
Checked on March 5, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Security Ninja
Checked on April 1, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Shield Security
Checked on January 19, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Sucuri Security
Checked on June 14, 2025See issues causing the plugin to get less than A+ grade
Plugin Security Scorecard Grade for Titan Anti-spam & Security
Checked on June 20, 2025See issues causing the plugin to get less than A+ grade