[Guide] How to unlock unlimited premium Wordfence Security license on any version

[Dobby]

Great find! Thank you so much!

 

[onprotech]

thank you

 

[simis0702]

hello guys, what is the difference between this method and the nulled version of wordfence?

 

[armotxa]

Super Thanks

 

[Syed92]

1. Download the official Wordfence security plugin from: https://en-ca.wordpress.org/plugins/wordfence/
2. Upload the plugin to your wordpress but don't activate it
3. Next, in your wordpress main dashboard head to Plugins -> Plugin Editor
4. In the "Select plugin to edit" bar choose Wordfence Security and press Select
5. Under the "lib file section" select the wordfenceClass.php file
6. Press ctrl+f and paste this:

if (!WFWAF_SUBDIRECTORY_INSTALL && $waf = wfWAF::getInstance()) {

You should see:

$updateCountries = false;
if (!WFWAF_SUBDIRECTORY_INSTALL && $waf = wfWAF::getInstance()) {
$homeurl = wfUtils::wpHomeURL();
$siteurl = wfUtils::wpSiteURL();


Now right under it paste this in:

wfConfig::set('isPaid', 1);
wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
wfConfig::set('premiumNextRenew', time()+31536000);

So the code should look like this:

$updateCountries = false;
if (!WFWAF_SUBDIRECTORY_INSTALL && $waf = wfWAF::getInstance()) {
$homeurl = wfUtils::wpHomeURL();
$siteurl = wfUtils::wpSiteURL();

wfConfig::set('isPaid', 1);
wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
wfConfig::set('premiumNextRenew', time()+31536000);

7. Save the file, then activate WordFence plugin, you should have unlimited premium license! It says "renew in 365 days" but you will notice that this number doesn't go down

If you can't find the code, you can export the file, edit using notepad++ and then reupload or do something similar. You can also use FTP application to do this method.

Like for more "exploits" like this!

"Amazing piece of code"
Many thanks for sharing. Your knowledge pleased many respected people here.

Best Regards !
Syed

 

[caguendeu]

1. Download the official Wordfence security plugin from: https://en-ca.wordpress.org/plugins/wordfence/
2. Upload the plugin to your wordpress but don't activate it
3. ...

Thanks a lot for this, @eliteshades, you rock!

We don't need to modify the plugin code. Use the following as a Must Use plugin (drop the php file inside wp-content/mu-plugins) and forget about it

<?php
add_action('plugins_loaded', function(){
    if( !class_exists('wfConfig') ) return;
    wfConfig::set('isPaid', 1);
    wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
    wfConfig::set('premiumNextRenew', time()+31536000);   
}, 99);

 

[NullMaster]

Thanks a lot for this, @eliteshades, you rock!

We don't need to modify the plugin code. Use the following as a Must Use plugin (drop the php file inside wp-content/mu-plugins) and forget about it

<?php
add_action('plugins_loaded', function(){
    if( !class_exists('wfConfig') ) return;
    wfConfig::set('isPaid', 1);
    wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
    wfConfig::set('premiumNextRenew', time()+31536000);  
}, 99);

missing information.

 

[xantor]

Thanks a lot for this, @eliteshades, you rock!

We don't need to modify the plugin code. Use the following as a Must Use plugin (drop the php file inside wp-content/mu-plugins) and forget about it

<?php
add_action('plugins_loaded', function(){
    if( !class_exists('wfConfig') ) return;
    wfConfig::set('isPaid', 1);
    wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
    wfConfig::set('premiumNextRenew', time()+31536000);  
}, 99);

Thanks!!!
I checked and it works!!
Just install the Code Snippets plugin, add the code as a snippet, and you are set, Word fence will be activated

add_action('plugins_loaded', function(){
    if( !class_exists('wfConfig') ) return;
    wfConfig::set('isPaid', 1);
    wfConfig::set('keyType', wfAPI::KEY_TYPE_PAID_CURRENT);
    wfConfig::set('premiumNextRenew', time()+31536000);  
}, 99);

 

[omar73x]

missing information.

i love your Bio

 

[Glastrier]

super! thanks

 

[techysoham]

It worked amazingly! I'm grateful to you buddy! Thanks a lot for this, @eliteshades

 

[r0manas]

Let me know if this exploit still works on newest version of wordfence, mine still says renew in 364 days

Just tried on the newest version and it works perfectly.
Thank You for sharing! We all babiato

Spoiler: Proof

 

[oscarb]

Thank you. Works like a charm !!!

 

[BuxB]

From CJ Chamberland over at GPLDL - WORDFENCE (not sure if I may link to his posting over there so I won't):

Just so you know, setting the values in the code does nothing but let you “think” you have premium. A valid premium key is required in order to get the updated WAF (Web Application Firewall) rules and Malware signatures. If one is not provided, you still only get the free even though the dashboard says you’re getting premium.

How can we tell how old WAF rules and Malware signatures are? This needs to be investigated. Please share your findings.

 

[xantor]

From CJ Chamberland over at GPLDL - WORDFENCE (not sure if I may link to his posting over there so I won't):

How can we tell how old WAF rules and malware signatures are? This needs to be investigated. Please share your findings.

Let's clarify this issue, not just for WordFence but for any plugin or service that requires an API key, email or specific credentials to update or download certain features. There is no way to null that!!!

You can null the plugin or theme to bypass the plugin security for the code that resides in your server, but you can't do anything for the part that is not on your server. That is why the elementor nulling, for example, requires that all templates be included with the nulled plugin, because the service will not let you download the templates without a valid license.

In this case, we would have to find a way to download the rules and add them to the plugin manually, but there is no way to update the rules just from nulling the plugin.

You are right that in order to solve this problem we need to investigate how the rules are updated. I don't use wordfence, but if someone is willing to investigate and find a way to download the specific files for the rule updates I could try to find away to merge and update them.

 

[BuxB]

As per this Wordfence support thread, rules are stored in wp-content/wflogs/rules.php. My rules file's time stamp is from today, and it is a pretty lengthy file.

 

[xantor]

As per this Wordfence support thread, rules are stored in wp-content/wflogs/rules.php. My rules file's time stamp is from today, and it is a pretty lengthy file.

Could you send the zipped files to [email protected] to take a look?

 

[BuxB]

It's only one file. This forum allows attaching of zipped files, so simply download and open the attachment

 

[xantor]

Could you also investigate where the malware signatures are stored?

 

[BuxB]

yep, busy trying to figure that out right now. My guess is in the mysql db