Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · watchtowerhq
WatchTowerHQ
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Dec 11, 2025WatchTowerHQ: Arbitrary file readCVE-2025-13972 · affects up to 3.16.0 · reported by WordfenceMedium 4.9
The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and including, 3.16.0. This is due to insufficient path validation in the handle_big_object_download_request function. This makes it possible for authenticated attackers, with administrator-level access and a valid access token, to read arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 25, 2024WatchTowerHQ: Authentication bypassCVE-2024-9933 · affects up to 3.10.1 · reported by WordfenceCritical 9.8
The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.10.1. This is due to the 'watchtower_ota_token' default value is empty, and the not empty check is missing in the 'Password_Less_Access::login' function. This makes it possible for unauthenticated attackers to log in to the WatchTowerHQ client administrator user.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 17, 2024WatchTowerHQ: Improper Privilege ManagementCVE-2023-25701 · affects up to 3.6.16 · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in WhatArmy WatchTowerHQ allows Privilege Escalation.This issue affects WatchTowerHQ: from n/a through 3.6.16.
Nov 18, 2022Unauth.CVE-2022-44584 · affects up to 3.6.15 · reported by PatchstackCritical 9.1
Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.
Nov 18, 2022Unauth.CVE-2022-44583 · affects up to 3.6.15 · reported by PatchstackHigh 7.5
Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.