Theme Editor
Avoid: vulnerability published 14 Feb 2026 still has no fix after 14 days.
Capped at 39 while a vulnerability has no patch.
| Ownership | 100 |
|---|---|
| Maintenance | 50 |
| Security | 20 |
| Support | 70 |
| Reputation | 70 |
Active signals
Facts we detected, with links to the source.
- CriticalSEC-2Vulnerability published 14 Feb 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.28 Feb 2026Evidence
- WarningMNT-2Tested up to WordPress 6.9.11, 2 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence
- InfoSEC-33 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| mndpsingh287 | 24 Apr 2017 to 19 Mar 2026, 46 commits |
|---|
1 committer recorded. No ownership changes recorded since 3 Nov 2026.
Maintenance
- Last release
- 8 months ago
- Releases, 24 months
- 0
- Tested up to
- 6.9 vs 7.1
- Requires PHP
- 5.2.4 supported 8.2+
Last release 19 Mar 2026. Tested up to 6.9, 2 major versions behind WordPress 7.1. Release history builds as we see new versions.
Support
0% of 1 support threads resolved in the last 2 months.
Security record
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 31 Jul 2026 | Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification | 4.3 | <= 3.1 | 3.2 | n/a |
| 14 Feb 2026 | Theme Editor <= 3.2 - Cross-Site Request Forgery | 4.3 | <= 3.2 | No fix | n/a |
| 17 Oct 2025 | Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution | 8.8 | <= 3.0 | 3.1 | n/a |
| 28 Aug 2024 | Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization | 7.2 | <= 2.8 | 2.9 | n/a |
| 20 Nov 2023 | Theme Editor <= 2.7.1 - Authenticated (Administrator+) Arbitrary File Upload | 7.2 | <= 2.7.1 | 2.8 | n/a |
| 13 Feb 2021 | Theme Editor <= 2.5 - Authenticated Arbitrary File Download | 4.9 | <= 2.5 | 2.6 | n/a |
| 30 Sep 2019 | Theme Editor <= 2.1 - Cross-Site Request Forgery | 8.8 | < 2.2 | 2.2 | n/a |
Source: Wordfence Intelligence.
Reputation
| Q4 2023 | 5.0 |
|---|---|
| Q1 2024 | 5.0 |
| Q2 2024 | 1.0 |
| Q3 2024 | 5.0 |
| Q4 2024 | 4.5 |
| Q1 2025 | 3.7 |
| Q4 2025 | 5.0 |
| Q1 2026 | 5.0 |
| Q3 2026 | 5.0 |
Average rating stayed at 5.0 between Q4 2023 and Q3 2026.
| 5 star | 108 |
|---|---|
| 4 star | 9 |
| 3 star | 2 |
| 2 star | 0 |
| 1 star | 9 |
- Huge problems, no thanks! · 1 star · 3 Jan 2025
- Not for the user… · 1 star · 15 Apr 2024
- Deletes file contents upon save. · 1 star · 1 Nov 2023
Momentum
50,000+ active installs. History builds with each weekly snapshot.
| 4 May 2026 | 1,048 |
|---|---|
| 11 May 2026 | 1,995 |
| 18 May 2026 | 4,804 |
| 25 May 2026 | 1,753 |
| 1 Jun 2026 | 1,623 |
| 8 Jun 2026 | 1,673 |
| 15 Jun 2026 | 1,637 |
| 22 Jun 2026 | 1,455 |
| 29 Jun 2026 | 1,511 |
| 6 Jul 2026 | 1,632 |
| 13 Jul 2026 | 1,526 |
| 20 Jul 2026 | 1,614 |
| 27 Jul 2026 | 1,685 |
| 3 Aug 2026 | 1,712 |
| 10 Aug 2026 | 1,648 |
| 17 Aug 2026 | 1,517 |
| 24 Aug 2026 | 1,575 |
| 31 Aug 2026 | 1,502 |
| 7 Sep 2026 | 1,522 |
| 14 Sep 2026 | 1,523 |
| 21 Sep 2026 | 1,680 |
| 28 Sep 2026 | 1,499 |
| 5 Oct 2026 | 1,399 |
| 12 Oct 2026 | 1,275 |
| 19 Oct 2026 | 1,705 |
| 26 Oct 2026 | 1,903 |
| 2 Nov 2026 | 254 |
Weekly downloads over the last 4 weeks are 22% below the 27-week average.
Healthier alternatives
Same category, higher Canary Score. Never sponsored.
Facts
| Version | 3.2 |
|---|---|
| Author | mndpsingh287 |
| Added | 24 Apr 2017 |
| Last updated | 19 Mar 2026 |
| Active installs | 50,000+ |
| Requires WordPress | 3.4 |
| Tested up to | 6.9.11 |
| Requires PHP | 5.2.4 |
| Category | Site Administration & Utilities > Site Migration & Cloning |
| Tags | wp, file, theme, editor, theme editor |
Other plugins by this author: Duplicate Page, File Manager, WP Mail, Sticky Header, Live Chat, Cryptocurrency Payment Gateway WooCommerce - MaxelPay, UTM Generator, Pattern Lock
Questions
Is Theme Editor still maintained?
Theme Editor was last updated on 19 Mar 2026. Its Canary status is Avoid.
Is Theme Editor safe?
Theme Editor has 1 published vulnerability with no patched version. Its Canary status is Avoid.
Who owns Theme Editor?
The wordpress.org author is mndpsingh287. Recent committers: mndpsingh287, plugin-master. We have recorded no ownership change.
What can I use instead of Theme Editor?
Plugins in the same category with a higher Canary Score: Htaccess File Editor - Safely Edit Htaccess File, WPIDE - File Manager & Code Editor, File Manager, FileOrganizer - WordPress File Manager, Advanced File Manager - Ultimate File Manager for WordPress And Document Library Solution.