CITT

    Scan results

    WordPress – Website Builder

    Android

    WordPress for Android puts the power of web publishing in your pocket. Create websites, blogs, and stories with a drag-and-drop builder. Publish content, track stats, and manage comments from your mobile device. 10M+ downloads.

    CITT SCORE
    45
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: WordPress users comfortable with standard analytics

    What It Means For You

    Activity and crash data is shared with Firebase, Sentry, and Google. Support interactions go through Zendesk, a third-party service. Several serious code-level problems were found that put account and stored data at elevated risk.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (17)

    Data Security

    3 total
    1 Critical
    1 High
    1 Medium

    Network Security

    2 total
    1 High
    1 Medium

    Code Security

    6 total
    2 Critical
    1 High
    1 Medium
    2 Low

    Privacy

    3 total
    2 High
    1 Medium

    Third-Party Risk

    3 total
    1 High
    2 Medium

    Third-Party Services

    Sentry, Zendesk, Firebase, Tenor GIF, Google Play Services, Gravatar

    Security Strengths

    • ✓HTTPS enforcement for all WordPress.com API calls
    • ✓EncryptedSharedPreferences for application passwords using AES-256-GCM with hardware-backed keys
    • ✓Secure backup configuration excluding sensitive data
    • ✓No debuggable flag in production build
    • ✓Analytics opt-out available
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    social
    sensitive data
    location
    ads

    Package

    org.wordpress.android

    Version

    26.3.1 (versionCode 1478)

    Analysis Date

    Jan 21, 2026

    Classes Analyzed

    450

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (1 critical, 1 high, 1 medium)

    Network Security - 2 findings (1 high, 1 medium)

    Code Safety - 0 findings

    Privacy - 3 findings (2 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    WordPress collects in-app activity, device information, crash reports, and error logs. Any content shared during a support session is handled by Zendesk, a third-party customer service platform. Profile images are loaded through Gravatar, which may log requests associated with user email addresses.

    Third-Party Data Sharing

    Data is shared with the following services:

    • Firebase (Google): Activity tracking and crash reporting
    • Sentry: Error and crash data collection
    • Zendesk: Customer support interactions
    • Google Play Services: Core platform functions
    • Tenor GIF: GIF search and content delivery
    • Gravatar: Profile image display

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy55/100
    Data Security30/100
    Network Security50/100
    Code Safety35/100
    Data Collection60/100
    Data Sharing55/100
    User Control75/100

    Positive Security Features

    No notable positive security practices were identified in this version of the app.

    Areas for Improvement

    • The protection of account data and stored content needs significant strengthening to reduce the risk of unauthorized access.
    • Connections between the app and external services should be made more robust to better protect user information while it travels across the network.
    • The way sensitive data is stored on the device should be reviewed and hardened to prevent potential misuse.

    About This Analysis

    App Details

    FieldValue
    AppWordPress - Website Builder
    Package IDorg.wordpress.android
    Version26.3.1 (versionCode 1478)
    Scan Date2026-01-21

    This scorecard is generated from automated static analysis of the app's code and behavior. Scores reflect the security and privacy practices observed at the time of the scan.

    Right of Reply

    Developer not yet contacted