-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
# [3.3.0] - 2024-08-02 **Added** * Ability to exclude of vulnerability types at a global level. * WP-CLI commands formats (--format=[table,json]). * REST API endpoints (requires Application Password). **Changed** * README file. **Compatibility** * WordPress: 4.1 - 6.7 * PHP: 5.6 - 8.3 * WP-CLI: 2.3.0 - 2.10.0 **Tests** * PHP Coding Standards: 3.10.2 * WordPress Coding Standards: 3.1.0 * Plugin Check (PCP): 1.0.2 * SonarCloud Code Review
- Loading branch information
Showing
3 changed files
with
78 additions
and
47 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,66 +9,69 @@ Version: 3.3.0 | |
| License: GPL-2.0-or-later | ||
| License URI: https://spdx.org/licenses/GPL-2.0-or-later.html | ||
|
|
||
| Receive information about possible vulnerabilities in your WordPress from [WordPress Vulnerability Database API](https://www.wpvulnerability.com/). | ||
| Get WordPress vulnerability alerts from [WordPress Vulnerability Database API](https://www.wpvulnerability.com/). | ||
|
|
||
| == Description == | ||
|
|
||
| This plugin taps into the power of the free and unlimited [WordPress Vulnerability Database API](https://www.wpvulnerability.com/) to deliver vulnerability assessments directly within your WordPress dashboard. It's an essential tool for website administrators, developers, and anyone keen on maintaining a secure WordPress environment. | ||
| This plugin integrates with the WPVulnerability API to provide real-time vulnerability assessments for your WordPress core, plugins, themes, PHP version, Apache HTTPD, and nginx. It delivers detailed reports directly within your WordPress dashboard, helping you stay aware of potential security risks. Configure the plugin to send periodic notifications about your site's security status, ensuring you remain informed without being overwhelmed. Designed for ease of use, it supports proactive security measures without storing or retrieving any personal data from your site. | ||
|
|
||
| Secure your WordPress experience today, your first line of defense against vulnerabilities! | ||
| = Data reliability = | ||
|
|
||
| = Comprehensive Security Analysis = | ||
| The information provided by the information database comes from different sources that have been reviewed by third parties. There is no liability of any kind for the information. Act at your own risk. | ||
|
|
||
| * Core: Checks the version of your WordPress Core against known vulnerabilities, ensuring you're always aware of potential risks. | ||
| * Plugin: Evaluates all your installed plugins, including those from the official repository, external sources, or premium ones, for any security weaknesses. | ||
| * Theme: Evaluates all your installed themes, including those from the official repository, external sources, or premium ones, for any security weaknesses. | ||
| * PHP: Analyzes your server's PHP version, detecting vulnerabilities specific to your PHP setup. This is crucial as outdated or unsupported PHP versions can significantly increase security risks. | ||
| * Apache HTTPD: Assesses the version of Apache HTTPD on your server, identifying any known vulnerabilities or misconfigurations that could compromise security. | ||
| * nginx: Evaluates the version of nginx on your server, pinpointing any known vulnerabilities or misconfigurations that could pose security threats. | ||
| == Using the plugin == | ||
|
|
||
| = In-Depth Vulnerability Reporting = | ||
| = WP-CLI = | ||
|
|
||
| Stay ahead of potential threats with detailed reports. If a vulnerability is detected, visit the 'Site Health' section in your WordPress dashboard for in-depth information. It informs you about the nature of the vulnerability and provides guidance, such as updating to a newer version or addressing issues with unsupported or unpatched plugins/themes. | ||
| You can use the following WP-CLI commands to manage and check vulnerabilities: | ||
|
|
||
| = Customizable Alert System = | ||
| * `wp wpvulnerability core`: Lists Core vulnerabilities. | ||
| * `wp wpvulnerability plugins`: Lists Plugins vulnerabilities. | ||
| * `wp wpvulnerability themes`: Lists Themes vulnerabilities. | ||
| * `wp wpvulnerability php`: Lists PHP vulnerabilities. | ||
| * `wp wpvulnerability apache`: Lists Apache HTTPD vulnerabilities. | ||
| * `wp wpvulnerability nginx`: Lists nginx vulnerabilities. | ||
|
|
||
| Configure the plugin to send periodic notifications about your site's security status. Choose between daily or weekly updates, ensuring you're always in the loop about your website's vulnerability status without being overwhelmed by information. | ||
| All commands support the `--format` option to specify the output format: | ||
|
|
||
| = Why Choose This Plugin? = | ||
| * `--format=table`: Displays the results in a table format (default). | ||
| * `--format=json`: Displays the results in JSON format. | ||
|
|
||
| * User-Friendly: Designed for ease of use; no technical expertise required. | ||
| * Proactive Security: Helps in early detection and resolution of security issues. | ||
| * Peace of Mind: Ensures you're always a step ahead in maintaining a secure WordPress site. | ||
| * Privacy-Conscious: The plugin operates with a strong commitment to privacy. It does not store any data from your site nor retrieves personal or sensitive information. | ||
| * Respect for Data Integrity: We understand the importance of your site’s integrity. The plugin works discreetly in the background, ensuring that your content and data remain untouched and unaffected during security checks. | ||
| Need help? | ||
|
|
||
| = Using the plugin = | ||
| * `wp wpvulnerability --help`: Displays help information for WPVulnerability commands. | ||
| * `wp wpvulnerability [command] --help`: Displays help information for a WPVulnerability command. | ||
|
|
||
| == WP-CLI == | ||
| = REST API = | ||
|
|
||
| And then, You will find these wpcli commands: | ||
| The WPVulnerability plugin provides several REST API endpoints to fetch vulnerability information for different components of your WordPress site. | ||
|
|
||
| * `wp wpvulnerability --help`: Get help with these commands. | ||
| * `wp wpvulnerability core`: List Core vulnerabilities. | ||
| * `wp wpvulnerability plugins`: List Plugins vulnerabilities. | ||
| * `wp wpvulnerability themes`: List Themes vulnerabilities. | ||
| * `wp wpvulnerability php`: List PHP vulnerabilities. | ||
| * `wp wpvulnerability apache`: List Apache HTTPD vulnerabilities. | ||
| * `wp wpvulnerability nginx`: List nginx vulnerabilities. | ||
| * `/wpvulnerability/v1/core`: Fetches Core vulnerabilities. | ||
| * `/wpvulnerability/v1/plugins`: Fetches Plugins vulnerabilities. | ||
| * `/wpvulnerability/v1/themes`: Fetches Themes vulnerabilities. | ||
| * `/wpvulnerability/v1/php`: Fetches PHP vulnerabilities. | ||
| * `/wpvulnerability/v1/apache`: Fetches Apache HTTPD vulnerabilities. | ||
| * `/wpvulnerability/v1/nginx`: Fetches nginx vulnerabilities. | ||
|
|
||
| == Configurations == | ||
| Authentication | ||
|
|
||
| **From mail** | ||
| The WPVulnerability REST API uses Application Passwords for authentication. You need to include a valid Application Password in the Authorization header of your requests. | ||
|
|
||
| _Since: 3.2.2_ | ||
| Example Request with Authentication | ||
|
|
||
| If, for some reason, you need the emails sent by the plugin to have a From different from the site administrator, you can change it from the `wp-config.php` by adding a constant: | ||
| ``` | ||
| curl -X GET https://example.com/wp-json/wpvulnerability/v1/plugins -u username:application_password | ||
| ``` | ||
|
|
||
| `define( 'WPVULNERABILITY_MAIL', '[email protected]' );` | ||
| Replace username with your WordPress `username` and `application_password` with your [Application Password](https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/). | ||
|
|
||
| = Data reliability = | ||
| == Extra Configurations == | ||
|
|
||
| The information provided by the information database comes from different sources that have been reviewed by third parties. There is no liability of any kind for the information. Act at your own risk. | ||
| = "From:" mail (since: 3.2.2) = | ||
|
|
||
| If, for some reason, you need the emails sent by the plugin to have a From different from the site administrator, you can change it from the `wp-config.php` by adding a constant: | ||
|
|
||
| `define( 'WPVULNERABILITY_MAIL', '[email protected]' );` | ||
|
|
||
| == Installation == | ||
|
|
||
|
|
@@ -106,26 +109,33 @@ First of all, peace of mind. Investigate what the vulnerability is and, above al | |
|
|
||
| == Compatibility == | ||
|
|
||
| * WordPress: 4.1 - 6.6 | ||
| * WordPress: 4.1 - 6.7 | ||
| * PHP: 5.6 - 8.3 | ||
| * WP-CLI: 2.3.0 - 2.10.0 | ||
|
|
||
| == Changelog == | ||
|
|
||
| = [3.3.0] - 2024-07-30 = | ||
| = [3.3.0] - 2024-08-02 = | ||
|
|
||
| **Added** | ||
|
|
||
| * Ability to exclude of vulnerability types at a global level. | ||
| * WP-CLI commands formats (--format=[table,json]). | ||
| * REST API endpoints (requires Application Password). | ||
|
|
||
| **Changed** | ||
|
|
||
| * README file. | ||
|
|
||
| **Compatibility** | ||
|
|
||
| * WordPress: 4.1 - 6.6 | ||
| * WordPress: 4.1 - 6.7 | ||
| * PHP: 5.6 - 8.3 | ||
| * WP-CLI: 2.3.0 - 2.10.0 | ||
|
|
||
| **Tests** | ||
|
|
||
| * PHP Coding Standards: 3.10.2 | ||
| * WordPress Coding Standards: 3.1.0 | ||
| * Plugin Check (PCP): 1.0.2 | ||
| * SonarCloud Code Review | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters