WP Cerber Security 9.10

In this release we strengthened two-factor authentication against repeated attempts, closed a gap in REST API user-data protection, and improved how untrusted data is handled in WP Cerber admin screens. We also corrected error reporting during GDPR personal data export and erasure, so Activity Log database failures are no longer mistaken for empty results.

Key Highlights

Stronger 2FA protection. WP Cerber now limits repeated 2FA challenges and incorrect PIN attempts per account. Exceeding these limits temporarily blocks new sign-ins and alerts the account owner.
More consistent REST API restrictions. The setting that blocks access to WordPress user data now covers additional request variations handled by WordPress.
Safer admin screens. Improved output escaping addresses a stored XSS vulnerability involving untrusted data displayed in WP Cerber admin screens.
Accurate GDPR results. Personal data export and erasure now report Activity Log read errors instead of incorrectly indicating success.

Security Changes

Two-factor authentication adds an important layer of protection when an account password is compromised. This release introduces per-account limits on 2FA challenges and incorrect PIN attempts, making repeated attempts to guess a PIN considerably more difficult.

The updated protection includes several changes:

Account-level limits. WP Cerber restricts how frequently new 2FA challenges can be requested and how many incorrect PIN attempts are permitted.
Temporary account locks. When the limits are exceeded, WP Cerber blocks new sign-ins to the affected account for 24 hours and notifies the account owner of a possible password compromise.
Consistent enforcement. The restrictions apply across supported sign-in methods, not just the standard WordPress login form.
Existing sessions remain valid. An account lock does not interrupt sessions that are already authenticated.
Safer error handling. If a security-critical error occurs during 2FA verification, WP Cerber denies the sign-in rather than allowing it to continue without 2FA.
Activity Log reporting. Account lock events are recorded in the Activity Log, helping administrators investigate suspicious sign-in activity.

Changing an account password does not remove an active lock. Administrators who have verified that an account is safe can restore access earlier using WP-CLI.

This is the first stage of our work on these safeguards. Further improvements to 2FA challenge handling are planned.

REST API user-data protection improved

The “Block access to users’ data via REST API” setting helps prevent public access to WordPress user information.

We identified and corrected an inconsistency between how WP Cerber checked certain REST API requests and how WordPress processed them. Under specific conditions, this could allow requests to bypass the intended restrictions.

WP Cerber now applies the protection more consistently across supported REST API request formats. We also improved coverage for related application-password routes.

The existing setting continues to work as before, with the additional protections applied automatically when it is enabled. No configuration changes are required.

Improved protection against stored XSS in admin screens

WP Cerber displays information from external sources in several parts of its administration interface. Such data must be treated as untrusted, even when it appears to contain ordinary text.

We corrected how certain externally supplied values are processed and displayed, addressing a stored cross-site scripting (XSS) vulnerability in the affected admin views.

The updated handling applies proper output escaping so that untrusted values are rendered as text rather than interpreted as executable content. The changes cover the relevant WP Cerber dashboard screens and Cerber.Hub interfaces.

Previously cached values are handled safely after updating. No additional configuration changes are required.

Admin Experience

Clearer account lock event label. The Activity Log event “Account is temporarily locked” now reads “Account temporarily locked”. The revised wording describes a recorded event rather than implying that the account is still locked.
Better diagnostics in the user summary. WP Cerber now logs failures to retrieve last-login records and BuddyPress activation details, making it easier to identify why certain information is missing from a user summary.

GDPR export and erasure now report Activity Log errors correctly

When an Activity Log database query failed, WP Cerber could interpret the result as an empty log rather than a database error. During GDPR personal data export and erasure, this could lead to misleading results.

We updated the Activity Log interface to distinguish database failures from legitimate empty results.

Personal data export now reports Activity Log read errors instead of incorrectly indicating that no activity was recorded or ending the export prematurely.
Personal data erasure no longer reports successful completion when an Activity Log database error prevents WP Cerber from verifying that the relevant records were removed.

For site owners handling privacy requests, this distinction matters. An empty result and a failed database query are not the same thing, and WP Cerber now reports them accordingly.

Tested compatibility

This release has been tested with PHP 7.4.33, 8.0.30, 8.1.34, 8.2.33, 8.3.33, 8.4.24, and 8.5.9, and with WordPress 5.8.14, 6.6.6, 6.7.6, 6.8.7, 6.9.6, and 7.1.

Bugfixes

BLOCKED and PROHIBITED labels restored on the Users page. Changes to the username column markup in WordPress caused our CSS rules to stop matching. The status labels and red highlighting of affected usernames are now displayed correctly again.
Malformed REST API requests no longer cause HTTP 500 errors. WP Cerber now handles unexpected REST API parameter formats without triggering an uncaught PHP error. Such requests are passed to WordPress for normal processing, without exposing user data.

Wonder what WP Cerber got in the previous version?

Review the release note for WP Cerber Security 9.9.5.

How to update WP Cerber

We recommend enabling automatic updates to ensure you always have the latest security features and performance improvements: how to enable automatic updates in the plugin settings.