When was WP Cerber Security v9.10 released?

WP Cerber Security version 9.10 was released on October 14, 2026. You can download it from GPLCoffee along with its full changelog and compatibility details.

What is the download size of WP Cerber Security v9.10?

The WP Cerber Security v9.10 package is 1.3 MB.

What WordPress version does WP Cerber Security v9.10 require?

WP Cerber Security v9.10 requires WordPress 5.8 or higher, tested up to WordPress 7.1.

What PHP version does WP Cerber Security v9.10 need?

WP Cerber Security v9.10 requires PHP 7.4 or higher.

Is WP Cerber Security v9.10 safe to download?

WP Cerber Security v9.10 has been scanned with VirusTotal and came back clean. The full scan report is linked from the version page.

Release v9.10

WP Cerber Security v9.10

Latest version

What's new in v9.10

WP Cerber Security v9.10 was released on October 14, 2026. Defends WordPress against hacker attacks, spam, trojans, and malware. See the full changelog below and compare with the complete version history.

Release details

Released October 14, 2026

1.3 MB

File available

Changelog

Other

Security: Two-factor authentication is now protected against PIN distributed brute-force attacks with per-account rate limiting. Each account can receive at most 5 new 2FA challenges per rolling hour and 10 per rolling 24 hours.
Security: When an account exceeds a 2FA challenge limit, WP Cerber blocks new sign-ins to that account for 24 hours and notifies the account owner of a possible password compromise.
Security: Hostnames obtained through reverse DNS lookups are now treated as untrusted data and escaped every time they are displayed in the admin area.
Security: Fixed a REST API user enumeration bypass. With "Block access to users' data via REST API" enabled, visitors blocked from the standard users route could still get the user list by changing the letter case or adding a trailing backslash or newline.

Fixed

A `rest_route` query parameter passed as an array, such as `?rest_route[]=x`, caused an uncaught `TypeError` (HTTP 500) in `CRB_Request::get_rest_api_path()`. WP Cerber now leaves such requests to WordPress, as on a site without WP Cerber.
The "BLOCKED" and "PROHIBITED" user status labels and the red highlighting of usernames were missing on the WordPress "Users" admin page after a change in the WordPress Users table markup. They are displayed again.
The GDPR personal data export now reports Activity log read errors. Previously, a database error could make the export state that no activity was logged or end the export early.
The GDPR personal data erasure no longer confirms that data was erased when a database error prevents WP Cerber from verifying that Activity log records were removed.

Improved

WP Cerber now recognizes the core REST API users routes the same way WordPress dispatches them: regardless of letter case, with trailing slashes and backslashes removed, and with one trailing newline allowed. All requests that were blocked before remain blocked.