[Guide] How to unlock unlimited premium Wordfence Security license on any version

eliteshades said:

1. Download the official Wordfence security plugin from: https://en-ca.wordpress.org/plugins/wordfence/
2. Upload the plugin to your wordpress but don't activate it
3. Next, in your wordpress main dashboard head to Plugins -> Plugin Editor
4. In the "Select plugin to edit" bar choose Wordfence Security and press Select
5. Under the "lib file section" select the wordfenceClass.php file
6. Press ctrl+f and paste this:

if (!WFWAF_SUBDIRECTORY_INSTALL && $waf = wfWAF::getInstance()) {

You should see:

$updateCountries = false;
if (!WFWAF_SUBDIRECTORY_INSTALL && $waf = wfWAF::getInstance()) {
$homeurl = wfUtils::wpHomeURL();
$siteurl = wfUtils::wpSiteURL();


Now right under it paste this in:

wfConfig::set('isPaid', 1);
wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
wfConfig::set('premiumNextRenew', time()+31536000);

So the code should look like this:

$updateCountries = false;
if (!WFWAF_SUBDIRECTORY_INSTALL && $waf = wfWAF::getInstance()) {
$homeurl = wfUtils::wpHomeURL();
$siteurl = wfUtils::wpSiteURL();

wfConfig::set('isPaid', 1);
wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
wfConfig::set('premiumNextRenew', time()+31536000);

7. Save the file, then activate WordFence plugin, you should have unlimited premium license! It says "renew in 365 days" but you will notice that this number doesn't go down

If you can't find the code, you can export the file, edit using notepad++ and then reupload or do something similar. You can also use FTP application to do this method.

Like for more "exploits" like this!

Click to expand...

eliteshades said:

1. Download the official Wordfence security plugin from: https://en-ca.wordpress.org/plugins/wordfence/
2. Upload the plugin to your wordpress but don't activate it
3. ...

Click to expand...

<?php
add_action('plugins_loaded', function(){
    if( !class_exists('wfConfig') ) return;
    wfConfig::set('isPaid', 1);
    wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
    wfConfig::set('premiumNextRenew', time()+31536000);   
}, 99);

caguendeu said:

Thanks a lot for this, @eliteshades, you rock!

We don't need to modify the plugin code. Use the following as a Must Use plugin (drop the php file inside wp-content/mu-plugins) and forget about it

Code:

<?php
add_action('plugins_loaded', function(){
    if( !class_exists('wfConfig') ) return;
    wfConfig::set('isPaid', 1);
    wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
    wfConfig::set('premiumNextRenew', time()+31536000);  
}, 99);

Click to expand...

caguendeu said:

Thanks a lot for this, @eliteshades, you rock!

We don't need to modify the plugin code. Use the following as a Must Use plugin (drop the php file inside wp-content/mu-plugins) and forget about it

Code:

<?php
add_action('plugins_loaded', function(){
    if( !class_exists('wfConfig') ) return;
    wfConfig::set('isPaid', 1);
    wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
    wfConfig::set('premiumNextRenew', time()+31536000);  
}, 99);

Click to expand...

add_action('plugins_loaded', function(){
    if( !class_exists('wfConfig') ) return;
    wfConfig::set('isPaid', 1);
    wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
    wfConfig::set('premiumNextRenew', time()+31536000);  
}, 99);

NullMaster said:

missing information.

Click to expand...

eliteshades said:

Let me know if this exploit still works on newest version of wordfence, mine still says renew in 364 days

Click to expand...

babiato

Spoiler: Proof

Just so you know, setting the values in the code does nothing but let you “think” you have premium. A valid premium key is required in order to get the updated WAF (Web Application Firewall) rules and Malware signatures. If one is not provided, you still only get the free even though the dashboard says you’re getting premium.

Click to expand...

BuxB said:

From CJ Chamberland over at GPLDL - WORDFENCE (not sure if I may link to his posting over there so I won't):

How can we tell how old WAF rules and malware signatures are? This needs to be investigated. Please share your findings.

Click to expand...

BuxB said:

As per this Wordfence support thread, rules are stored in wp-content/wflogs/rules.php. My rules file's time stamp is from today, and it is a pretty lengthy file.

Click to expand...