Is WorldEdit safe? Yes, as long as you get it from the sources EngineHub points to. It's an open-source tool (GPLv3) that's been around since 2010, and the GitHub repo shows no published security advisories as of November 2026. The risks that are left are practical: a download from some random site, a big edit that crashes your game, and a server that doesn't want you using it.
WorldEdit is an in-game map editor: select an area, then copy, paste, fill, replace or brush it. It's Java Edition only, and the mod and the plugin are two different builds, which trips a lot of people up.
Where to download the real WorldEdit
EngineHub, the team behind it, points to a short list:
- Modrinth for the Bukkit, NeoForge and Fabric builds. The GitHub README says this is where to go if you just want to use it.
- Ore for Sponge.
- builds.enginehub.org for experimental builds straight from EngineHub's own build server. Stable is what you want unless you're testing.
That's the list I'd trust. If you land on a copy somewhere else, check that the project is by EngineHub before you download. Hypixel gives the same general advice for any mod: get it from the creator's own site or GitHub, because unofficial copies can carry bugs, hidden features or malicious code. If you want to know how Modrinth itself holds up, I wrote up whether Modrinth is safe, and there's a matching one for CurseForge.
Forge used to be officially supported but isn't any more. On Modrinth the page lists Bukkit, Fabric, Folia, Forge, NeoForge, Paper, Quilt and Spigot, and it says plainly that Bedrock isn't supported. There's no WorldEdit for Realms, Windows 10 Edition or Pocket Edition.
Mod or plugin: what you actually install
It ships both ways, and you need the one that matches how you play:
| How you play | What you need |
|---|---|
| Single-player | The mod, on NeoForge or Fabric (EngineHub's docs recommend those) |
| Your own server on Paper or Spigot | The plugin. Paper is the one the docs recommend over Spigot |
| Your own server on NeoForge, Fabric or Sponge | The mod (Sponge's build comes from Ore) |
Paper and Spigot run plugins, which mostly won't work with NeoForge, Fabric or Sponge mods, and the other way round. The plugin build also needs to match your Minecraft version, so update it after each Minecraft release. EngineHub's security policy only covers the latest Minecraft release and the latest WorldEdit release, so stay current. The most recent release I found was 7.4.6, from October 2026.
Modrinth also mentions opt-out telemetry: the Bukkit build has a bStats integration. Opt-out means it's on unless you turn it off.
The security side, and log4j
EngineHub has a security policy: report vulnerabilities to security@enginehub.org. One line in it matters for how you think about the tool: WorldEdit is designed to be an admin tool, so someone with permission using it to break limits or cause lag isn't treated as a vulnerability. Lag from a player without permission would be.
About log4j: Log4Shell (CVE-2021-44228, December 2021) was a critical remote-code-execution hole in Log4j 2.14.1 and earlier. I haven't found any advisory that names WorldEdit, and its GitHub security page has none published. When someone asked exactly this on SpigotMC in 2022, the reply was that plugins use whatever Log4j the server software ships, so the fix was a server jar built after mid-December 2021. That's one forum answer, not EngineHub, so keep your server software current either way.
Can WorldEdit wreck your world?
It can, because it's built to change thousands of blocks in one command. Some of the damage control is built in:
- Undo. Every command or tool action goes into your session history, and by default it keeps your last 15 actions.
//undoreverses the latest,//undo 5reverses five, and//redobrings it back./clearhistorywipes the lot. - Undo has holes. Only direct changes are recorded. Liquid that starts flowing afterwards, and attached blocks that pop off (doors, signs, tall grass), aren't tracked, so undo won't always put things back exactly.
- Limits. The default change limit is unlimited (-1). Server owners can cap it with
//limitor the config. The maximum brush radius defaults to 6, and a list of disallowed blocks covers physics blocks that can lag or crash things. - Big edits. Edits of a million blocks or more can crash a server or client, from a watchdog timeout or running out of memory. The docs suggest about 1 GB for the server plus about 2 GB per ten million blocks.
My own rule: copy your world folder before any big edit, because undo doesn't catch everything. Start with small selections until you trust what a command does.
Do servers allow WorldEdit?
On your own world or server
In single-player you need cheats enabled for the world. On a server, only ops or players you've given permissions to (through a permissions plugin) can use it. On a LAN, anyone can if cheats are on. Setting block entities like signs and chests needs the worldedit.setnbt permission. If you're setting up your own, how to make a Minecraft server covers the basics, and if you'd rather build on someone else's server, there's my roundup of Minecraft creative servers.
The mod is for your own world or a server you run. On someone else's server you won't have the permission to use it anyway.
Hypixel
Hypixel's Allowed Modifications page doesn't name WorldEdit. It lists categories it allows: client performance, aesthetic, cosmetic HUD and brightness. Then it says that if a modification doesn't fit one of them, you should assume it's disallowed by default. WorldEdit doesn't fit any of those, so I'd treat it as not allowed there and keep it out of the profile you use for Hypixel. Hypixel doesn't say "WorldEdit gets you banned" either. Forum answers are all over the place, and none of them are staff.
For any other server, read its rules before you assume. For the wider picture on mods, see whether Minecraft mods are safe.
So, is WorldEdit safe?
Yes, for what it is: an open-source builder's tool from a long-running team with no published security advisories. Download it from Modrinth, Ore or EngineHub's builds, pick the mod or plugin that fits your setup, and be careful with huge selections. Back up first. Don't plan on using it on Hypixel, since it falls outside what Hypixel allows by default.