Skip to content
PluginCanary

WP-WebAuthn

by Axton · 2,000+ active installs · Checked 3 Nov 2026
Watch1 Warning

Watch: tested up to WordPress 6.9.11, 2 major versions behind 7.1.4.

77/ 100 Canary Score
Sub-scores for WP-WebAuthn
Ownership100
Maintenance50
Security95
Support70
Reputation70

How the score works

Quick answers

Is WP-WebAuthn still maintained?
Yes. Last release 15 Apr 2026, 2 releases in the last 24 months. 15 Apr 2026 · wordpress.org
Who owns WP-WebAuthn, and has it changed hands?
No change recorded. Main committer axton since Mar 2020. 3 Nov 2026 · SVN log
Was WP-WebAuthn removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WP-WebAuthn safe?
3 known vulnerabilities, all fixed (latest in 1.3.2). Not on the exploited list. 20 Mar 2026 · Wordfence Intelligence
Is the latest WP-WebAuthn update safe to install?
No ownership change before 1.4.1. No one-star spike after it. 15 Apr 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • WarningMNT-2Tested up to WordPress 6.9.11, 2 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master23 Mar 2020 to 23 Mar 2020, 1 commits
axton24 Mar 2020 to 15 Apr 2026, 55 commits

2 committers recorded. No ownership change since 2020.

Maintenance

Last release
7 months ago
Releases, 24 months
2
Tested up to
6.9 vs 7.1
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for WP-WebAuthn
Q1 20240
Q2 20240
Q3 20240
Q4 20243
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20262
Q3 20260
Q4 20260

Last release 15 Apr 2026. Tested up to 6.9, 2 major versions behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 4.5.

Rating distribution
5 star14
4 star0
3 star1
2 star1
1 star1

Security record

1 vulnerability in 24 months (3 on record), patched (latest fixed in 1.3.2).

Show 3 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
20 Mar 2026WP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site Scripting6.1<= 1.3.4Not affectedn/a
30 Sep 2024WP-WebAuthn <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 1.3.11.3.21
27 Sep 2024WP-WebAuthn <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode6.4<= 1.3.31.3.48

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

0% of 1 support threads resolved in the last 2 months.

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP-WebAuthn
4 May 202699
11 May 2026197
18 May 2026184
25 May 2026177
1 Jun 2026141
8 Jun 2026139
15 Jun 2026121
22 Jun 202682
29 Jun 2026109
6 Jul 2026100
13 Jul 2026122
20 Jul 2026120
27 Jul 2026123
3 Aug 2026125
10 Aug 2026140
17 Aug 2026162
24 Aug 2026135
31 Aug 2026158
7 Sep 2026152
14 Sep 2026129
21 Sep 2026126
28 Sep 2026152
5 Oct 2026142
12 Oct 2026183
19 Oct 2026335
26 Oct 2026234
2 Nov 202646

Weekly downloads over the last 4 weeks are 37% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

LoginizerScore 93 · 1,000,000+FluentAuthScore 93 · 10,000+All In One LoginScore 92 · 60,000+WPS Hide LoginScore 91 · 2,000,000+Temporary Login Without PasswordScore 91 · 90,000+

Facts

Version1.4.1
AuthorAxton
Added24 Mar 2020
Last updated15 Apr 2026
Active installs2,000+
Requires WordPress5.0
Tested up to6.9.11
Requires PHP7.4
CategorySecurity & Privacy > Security Scanning & Malware Protection
Tagsfido, login, passkey, security, webauthn

Questions

Is WP-WebAuthn still maintained?

Yes. Last release 15 Apr 2026, 2 releases in the last 24 months.

Who owns WP-WebAuthn, and has it changed hands?

No change recorded. Main committer axton since Mar 2020.

Was WP-WebAuthn removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WP-WebAuthn safe?

3 known vulnerabilities, all fixed (latest in 1.3.2). Not on the exploited list.

Is the latest WP-WebAuthn update safe to install?

No ownership change before 1.4.1. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue