Title: WPVulnerability Author: ROBOTSTXT.es Published: Май 6, 2022 Last modified: Август 23, 2026 --- Search plugins ![](https://ps.w.org/wpvulnerability/assets/banner-772x250.png?rev=3387690) ![](https://ps.w.org/wpvulnerability/assets/icon.svg?rev=3387690) # WPVulnerability By [ROBOTSTXT.es](https://profiles.wordpress.org/robotstxt/) [Download](https://downloads.wordpress.org/plugin/wpvulnerability.5.1.6.zip) * [Details](https://tg.wordpress.org/plugins/wpvulnerability/#description) * [Reviews](https://tg.wordpress.org/plugins/wpvulnerability/#reviews) * [Installation](https://tg.wordpress.org/plugins/wpvulnerability/#installation) * [Development](https://tg.wordpress.org/plugins/wpvulnerability/#developers) [Support](https://wordpress.org/support/plugin/wpvulnerability/) ## Description This plugin integrates with the WPVulnerability API to provide real-time vulnerability assessments for your WordPress core, plugins, themes, PHP version, Apache HTTPD, nginx, MariaDB, MySQL, ImageMagick, curl, memcached, Redis, and SQLite. It delivers detailed reports directly within your WordPress dashboard, helping you stay aware of potential security risks. Configure the plugin to send periodic notifications about your site’s security status, ensuring you remain informed without being overwhelmed. Designed for ease of use, it supports proactive security measures without storing or retrieving any personal data from your site. #### Data reliability The information provided by the information database comes from different sources that have been reviewed by third parties. There is no liability of any kind for the information. Act at your own risk. ### Using the plugin #### WP-CLI You can use the following WP-CLI commands to manage and check vulnerabilities: * Core: `wp wpvulnerability core` * Plugins: `wp wpvulnerability plugins` * Themes: `wp wpvulnerability themes` * PHP: `wp wpvulnerability php` * Apache HTTPD: `wp wpvulnerability apache` * nginx: `wp wpvulnerability nginx` * MariaDB: `wp wpvulnerability mariadb` * MySQL: `wp wpvulnerability mysql` * ImageMagick: `wp wpvulnerability imagemagick` * curl: `wp wpvulnerability curl` * memcached: `wp wpvulnerability memcached` * Redis: `wp wpvulnerability redis` * SQLite: `wp wpvulnerability sqlite` To configure the plugin you can use: * Hide component: `wp wpvulnerability config hide [on|off]` * Notification email: `wp wpvulnerability config email ` (comma separatted) * Notification period: `wp wpvulnerability config period ` * Log retention: `wp wpvulnerability config log-retention <0|1|7|14|28>` (in days) * Cache duration: `wp wpvulnerability config cache <1|6|12|24>` (in hours) All commands support the `--format` option to specify the output format: * `--format=table`: Displays the results in a table format (default). * `--format=json`: Displays the results in JSON format. Need help? * `wp wpvulnerability --help`: Displays help information for WPVulnerability commands. * `wp wpvulnerability [command] --help`: Displays help information for a WPVulnerability command. #### REST API The WPVulnerability plugin provides several **REST API endpoints** to fetch vulnerability information for different components of your WordPress site. * Core: `/wpvulnerability/v1/core` * Plugins: `/wpvulnerability/v1/plugins` * Themes: `/wpvulnerability/v1/themes` * PHP: `/wpvulnerability/v1/php` * Apache HTTPD: `/wpvulnerability/v1/apache` * nginx: `/wpvulnerability/v1/nginx` * MariaDB: `/wpvulnerability/v1/mariadb` * MySQL: `/wpvulnerability/v1/mysql` * ImageMagick: `/wpvulnerability/v1/imagemagick` * curl: `/wpvulnerability/v1/curl` * memcached: `/wpvulnerability/v1/memcached` * Redis: `/wpvulnerability/v1/redis` * SQLite: `/wpvulnerability/v1/sqlite` The WPVulnerability REST API uses **Application Passwords** for authentication. You need to include a valid Application Password in the Authorization header of your requests. Example Request with Authentication ``` curl -X GET https://example.com/wp-json/wpvulnerability/v1/plugins -u username:application_password ``` Replace username with your WordPress `username` and `application_password` with your [Application Password](https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/). ### Extra Configurations #### «From:» mail (since: 3.2.2) If, for some reason, you need the emails sent by the plugin to have a From different from the site administrator, you can change it from the `wp-config.php` by adding a constant: ``` define( 'WPVULNERABILITY_MAIL', 'sender@example.com' ); ``` If the constant is active, it will be visible in the configuration screen. #### Force hiding checks (since: 4.1.0) If you want to always hide a specific component, you can define a constant in `wp- config.php`. When set to `true`, the option will be checked automatically in the settings screen and the related analysis will be skipped. Example: ``` define( 'WPVULNERABILITY_HIDE_APACHE', true ); ``` Available constants: `WPVULNERABILITY_HIDE_CORE`, `WPVULNERABILITY_HIDE_PLUGINS`,` WPVULNERABILITY_HIDE_THEMES`, `WPVULNERABILITY_HIDE_PHP`, `WPVULNERABILITY_HIDE_APACHE`,` WPVULNERABILITY_HIDE_NGINX`, `WPVULNERABILITY_HIDE_MARIADB`, `WPVULNERABILITY_HIDE_MYSQL`,` WPVULNERABILITY_HIDE_IMAGEMAGICK`, `WPVULNERABILITY_HIDE_CURL`, `WPVULNERABILITY_HIDE_MEMCACHED`,` WPVULNERABILITY_HIDE_REDIS`, `WPVULNERABILITY_HIDE_SQLITE`. #### Cache duration (since: 4.1.0) By default, data from the API is cached for 12 hours. To change this, define `WPVULNERABILITY_CACHE_HOURS` in `wp-config.php` with one of `1`, `6`, `12` or `24`. This value overrides the setting screen and WP-CLI command. ``` define( 'WPVULNERABILITY_CACHE_HOURS', 24 ); ``` #### Log rotation (since: 4.2.0) WPVulnerability stores the most recent API responses so you can review recent calls from the new log tab. Define `WPVULNERABILITY_LOG_RETENTION_DAYS` in `wp-config. php` to control how many days of entries are preserved. Supported values are `0`,` 1`, `7`, `14` or `28`; using `0` disables logging entirely. ``` define( 'WPVULNERABILITY_LOG_RETENTION_DAYS', 14 ); ``` When the constant is present its value is enforced in the settings UI and through WP-CLI, ensuring consistent log rotation across environments. #### Security configuration (since: 4.3.0) WPVulnerability uses a hybrid detection approach for server software (ImageMagick, Redis, Memcached, SQLite): PHP extensions first (most secure), then shell commands as fallback (most accurate). You can control this behavior using security configuration constants in `wp-config.php`. **Global disable of shell commands:** ``` define( 'WPVULNERABILITY_DISABLE_SHELL_EXEC', true ); ``` Completely disables shell command usage. Falls back to PHP extensions only. Use for maximum security when accuracy loss is acceptable. **Security mode (standard/strict/disabled):** ``` define( 'WPVULNERABILITY_SECURITY_MODE', 'strict' ); ``` * `standard` – Hybrid detection: PHP extensions first, shell commands fallback ( default, best accuracy) * `strict` – PHP extensions only, no shell commands (high security, lower accuracy) * `disabled` – No software detection at all (maximum security) **Component whitelist:** ``` define( 'WPVULNERABILITY_SHELL_EXEC_WHITELIST', 'imagemagick,redis' ); ``` Allows shell commands only for specified components. Available components: `imagemagick`,` redis`, `memcached`, `sqlite`. Use for granular control. **Examples:** Maximum security (no shell commands): ``` define( 'WPVULNERABILITY_SECURITY_MODE', 'strict' ); ``` Only allow ImageMagick shell detection: ``` define( 'WPVULNERABILITY_SHELL_EXEC_WHITELIST', 'imagemagick' ); ``` Complete disable: ``` define( 'WPVULNERABILITY_DISABLE_SHELL_EXEC', true ); ``` All shell commands are hardcoded and validated – no user input is involved. Commands are logged for security auditing. ### Compatibility * WordPress: 4.7 – 7.1 * PHP: 7.0 – 8.5 * WP-CLI: 2.3.0 – 2.12.0 ### Security This plugin adheres to the following security measures and review protocols for each version: * [WordPress Plugin Handbook](https://developer.wordpress.org/plugins/) * [WordPress Plugin Security](https://developer.wordpress.org/plugins/wordpress-org/plugin-security/) * [WordPress APIs Security](https://developer.wordpress.org/apis/security/) * [WordPress Coding Standards](https://github.com/WordPress/WordPress-Coding-Standards) * [Plugin Check (PCP)](https://wordpress.org/plugins/plugin-check/) ### Privacy * This plugin or the WordPress Vulnerability Database API does not collect any information about your site, your identity, the plugins, themes or content the site has. ### Vulnerabilities * A security vulnerability was found and fixed in version 4.2.2.1. All previous versions (3.3.0 – 4.2.1) are affected. Please update to version 4.2.2.1 or later. Found a security vulnerability? Please report it to us privately at [ROBOTSTXT](https://www.robotstxt.es/contacto/). ### Contributors You can contribute to this plugin at the [WPVulnerability repository](https://git.robotstxt.es/ROBOTSTXT/wpvulnerability). ## Screenshots [⌊WP-Admin Dashboard widget.⌉⌊WP-Admin Dashboard widget.⌉[ WP-Admin Dashboard widget. [⌊Vulnerability list at Plugins list.⌉⌊Vulnerability list at Plugins list.⌉[ Vulnerability list at Plugins list. [⌊Vulnerability list at Site Health.⌉⌊Vulnerability list at Site Health.⌉[ Vulnerability list at Site Health. ## Installation #### Automatic download Visit the plugin section in your WordPress, search for [wpvulnerability]; download and install the plugin. #### Manual download Extract the contents of the ZIP and upload the contents to the `/wp-content/plugins/ wpvulnerability/` directory. Once uploaded, it will appear in your plugin list. ## FAQ ### Where does the vulnerability information come from? The origin is in the WPVulnerability.com API. The vulnerabilities that appear in this API come from different sources, such as CVEs. ### Is data from my site sent anywhere? No. Never. Your privacy is very important to us. We do not commercialize with your data. ### What vulnerabilities will I find? Vulnerabilities in WordPress Core, Plugins, Themes, PHP, Apache HTTPD, nginx, MariaDB, MySQL, ImageMagick, curl, memcached, Redis, and SQLite are documented. ### What do I do if my site has a vulnerability? First of all, peace of mind. Investigate what the vulnerability is and, above all, check that you have the latest version of the compromised element. We actively recommend that you keep all your WordPress and its plugins up to date. Contact your hosting provider to patch non-WordPress vulnerabilities (like web server, databases, and other software). ## Reviews ![](https://secure.gravatar.com/avatar/01a4d1de8bdc699d5b30bebea22dbfb690d1fc526025b757faaf5746ddce837f? s=60&d=retro&r=g) ### 󠀁[Wow, most useful wordpress plugin for security!](https://wordpress.org/support/topic/wow-most-useful-wordpress-plugin-for-security/)󠁿 [Bubalubs](https://profiles.wordpress.org/bubalubs/) Январ 28, 2025 1 reply It is a must have install on every WP project for security and maintaince! 🙂 Backed up by a open API that shares vulnerabilities. Thank you! 😊 ![](https://secure.gravatar.com/avatar/6781e84707046fa72f9227dbc9acbcfdae4b32cef8df4331dbb55e778a72a9f3? s=60&d=retro&r=g) ### 󠀁[Essential plugin](https://wordpress.org/support/topic/essential-plugin-252/)󠁿 [Dan Bamber](https://profiles.wordpress.org/danbamber/) Январ 28, 2025 1 reply Without a doubt, the most important plugin to install on your WordPress instance. ![](https://secure.gravatar.com/avatar/694af5784d386616f5b9fa898c055fe7f101258d140919833a024992451ade95? s=60&d=retro&r=g) ### 󠀁[Mi herramienta principal de diagnóstico](https://wordpress.org/support/topic/mi-herramienta-principal-de-diagnostico/)󠁿 [Lolo Marchal](https://profiles.wordpress.org/chipweb/) Май 28, 2024 Resume en un solo plugin todas las vulnerabilidades tu WordPress, Plugins y Themes. Para mi es un «musthave» desde hace más de 1 año. Lo instalo en todas mis auditorías. ![](https://secure.gravatar.com/avatar/87655adbe9c370936dcf446c1d77671f70f39b634917183c7fb97ac4098a95fc? s=60&d=retro&r=g) ### 󠀁[This is awesome](https://wordpress.org/support/topic/this-is-awesome-121/)󠁿 [pixluser](https://profiles.wordpress.org/pixluser/) Апрел 17, 2024 Vulnerabilities are listed into your plugins list.You should also being able to receive an automatic email too. It doesn’t work on my system, but email test yes. So awesome plugin anyway! ![](https://secure.gravatar.com/avatar/35745cbb4065201434c30aad2e5980133a6a987f4dbbba485c04da8d57601f26? s=60&d=retro&r=g) ### 󠀁[Perfect](https://wordpress.org/support/topic/perfect-10327/)󠁿 [Groovyx9](https://profiles.wordpress.org/groovyx9/) Апрел 8, 2024 1 reply Exactly what I was looking for ! On the roadmap, it would be nice if : we can chose if we want to receive an email OR not (I may use it as a vuln reminder on the dashboard, as I have other plugins already keeping me informed) we can chose what will be in the email – php or not for exemple (it seems that it is planned, thanks) only receive an email if one the vuln is considered high risk etc. ![](https://secure.gravatar.com/avatar/f2949e1420c186ba7fe9eafb8f5c406b6b29ddebb639e7c7da6f93d39b784643? s=60&d=retro&r=g) ### 󠀁[Must have](https://wordpress.org/support/topic/must-have-700/)󠁿 [Martin Sauter](https://profiles.wordpress.org/martinsauter/) Феврал 21, 2024 This plugin alerts you about known vulnerabilities in your WordPress core, plugins, themes, and even PHP, so you can take action in a timely manner. If you don’t have this plugin on your site already, you absolutely need it! [ Read all 19 reviews ](https://wordpress.org/support/plugin/wpvulnerability/reviews/) ## Contributors & Developers “WPVulnerability” is open source software. The following people have contributed to this plugin. Contributors * [ ROBOTSTXT.es ](https://profiles.wordpress.org/robotstxt/) * [ Javier Casares ](https://profiles.wordpress.org/javiercasares/) * [ David Perez ](https://profiles.wordpress.org/davidperez/) * [ Lucas Bonomo ](https://profiles.wordpress.org/lbonomo/) * [ Alex Lion (阿力獅) ](https://profiles.wordpress.org/alexclassroom/) “WPVulnerability” has been translated into 14 locales. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/wpvulnerability/contributors) for their contributions. [Translate “WPVulnerability” into your language.](https://translate.wordpress.org/projects/wp-plugins/wpvulnerability) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/wpvulnerability/), check out the [SVN repository](https://plugins.svn.wordpress.org/wpvulnerability/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/wpvulnerability/) by [RSS](https://plugins.trac.wordpress.org/log/wpvulnerability/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### [5.1.6] – 2026-08-22 **Fixed** * Saving the «Delete all plugin data on uninstall» preference no longer triggers a fatal error (`add_settings_error()` was called before the WordPress admin API was loaded). * Notification channels can now be disabled entirely: unchecking every channel and saving previously kept the old channels active, because unchecked checkboxes are never submitted. * «Reset Plugin» and «Delete all logs» now purge both log stores (API request logs and shell execution audit logs). Previously the shell audit store was never cleaned, and both deletions silently did nothing because the log post types were not registered yet when the actions ran. * The Debug tab API connectivity tests now use the real API routes: WordPress core collapses pre-release versions (e.g. 7.1-alpha) to their stable milestone, and plugins/themes are tested against their actual slug routes instead of nonexistent plural ones (HTTP 404). * Component icons now carry explicit width/height attributes and a meaningful alt text. The same icons are embedded in notification emails and Site Health, where the plugin CSS is not loaded and unsized SVGs rendered at their intrinsic 800 ×800 size. **Changed** * `languages/wpvulnerability.pot` regenerated with the new strings. **Compatibility** * WordPress: 4.7 – 7.1 * PHP: 7.0 – 8.5 * WP-CLI: 2.3.0 – 2.12.0 **Tests** * PHP Coding Standards: 3.13.6 (0 errors) * WordPress Coding Standards: 3.4.1 * PHPStan: 2.2.9 (level 9, 0 errors) * PHPUnit: 9.6.36 (54 tests) #### [5.1.5] – 2026-08-22 **Changed** * The contributor list now leads with the ROBOTSTXT organization account, followed by Javier Casares; the remaining contributors are unchanged. * Regenerated `languages/wpvulnerability.pot` so its source references match the current code. The string set is unchanged (450 strings); all shipped translations were verified against it and remain fully up to date. **Compatibility** * WordPress: 4.7 – 7.1 * PHP: 7.0 – 8.5 * WP-CLI: 2.3.0 – 2.12.0 **Tests** * PHP Coding Standards: 3.13.6 * WordPress Coding Standards: 3.4.1 * PHPStan: 2.2.9 (level 9, 0 errors) * PHPUnit: 9.6.36 (45 tests) #### [5.1.4] – 2026-08-22 **Highlights** * The Site Health vulnerability tests work again on every WordPress version: they were silently disabled everywhere by an availability gate that could never pass. Secrets are now masked in the admin forms, and compatibility was verified against real PHP interpreters from 5.6 to 8.5. **Fixed** * The Site Health integration registered its tests behind `class_exists( 'WP_Site_Health')`, but core loads that class lazily, after `init`, where the plugin loads its modules— so the guard always evaluated to false and none of the 13 vulnerability tests ever appeared in Site Health. The filter is now registered unconditionally; below WordPress 5.2 it simply never fires. * «Clear all caches» in the debug tools now also deletes the `wpvulnerability-plugins- cache-data` timestamp option, so the plugins dataset is fully refreshed afterwards. * The notification email «From:» address is now sanitized with `sanitize_email()` on all code paths. * The plugins list table «Last updated» column decoded the whole plugins dataset for every table row; it is now decoded once per request. * Removed a duplicated `json_decode()` call when reading the vulnerable-themes count. * The `wp_date()` compatibility polyfill no longer fatals on WordPress 4.7–5.3: core calls `wp_maybe_decline_date()` unconditionally, but that function only exists since 5.4; the call is now availability-guarded. * The core and software JSON getters return `'[]'` instead of an empty string when encoding fails, matching the plugins and themes getters. **Security** * Webhook URLs (Slack, Teams, Discord) and the Telegram bot token are masked in the admin settings forms (single-site and network), showing only their last 4 characters — previously they were rendered in full into the page HTML. The inputs are plain text fields, so masked values never trigger browser URL validation. Saving a form with unchanged masked values keeps the stored secret; clearing a field still removes it. * Removed the dead `register_uninstall_hook()` registration: `uninstall.php` supersedes it and the registration added a stray autoloaded option row. * Single-site settings registrations now explicitly set `show_in_rest => false`, matching the multisite configuration. **Changed** * Admin CSS/JS assets load only on the WPVulnerability settings pages, the dashboard and the plugins/themes list tables instead of on every wp-admin screen. * The shell availability probe (`wpvulnerability_can_shell_exec()`) result is cached per request instead of spawning a process on every call. **Compatibility** * WordPress: 4.7 – 7.1 * PHP: 7.0 – 8.5 * WP-CLI: 2.3.0 – 2.12.0 * Verified against real PHP interpreters 5.6.40, 7.0.33, 7.1.33, 7.2.34, 7.3.33, 7.4.33, 8.0.30, 8.1.34, 8.2.33, 8.3.33, 8.4.24 and 8.5.9: every plugin file lints clean from 7.0 up and fails on 5.6, confirming the declared floor. PHPCompatibility gate 7.0-8.5 clean; wp-compat WordPress floor 4.7 clean. **Tests** * PHP Coding Standards: 3.13.6 * WordPress Coding Standards: 3.4.1 * PHPStan: 2.2.9 (level 9, 0 errors) * PHPUnit: 9.6.36 (45 tests) #### Previous versions If you want to see the full changelog, visit the [changelog.txt](https://plugins.trac.wordpress.org/browser/wpvulnerability/trunk/changelog.txt) file. ## Community plugin This plugin is developed and supported by a community. [Contribute to this plugin](https://git.robotstxt.es/ROBOTSTXT/wpvulnerability) ## Meta * Version **5.1.6** * Last updated ** 6 соат ago** * Active installations **10,000+** * WordPress version ** 4.7 or higher ** * Tested up to **7.1** * PHP version ** 7.0 or higher ** * Languages * [Catalan](https://ca.wordpress.org/plugins/wpvulnerability/), [Chinese (Taiwan)](https://tw.wordpress.org/plugins/wpvulnerability/), [Dutch](https://nl.wordpress.org/plugins/wpvulnerability/), [Dutch (Belgium)](https://nl-be.wordpress.org/plugins/wpvulnerability/), [English (US)](https://wordpress.org/plugins/wpvulnerability/), [Galician](https://gl.wordpress.org/plugins/wpvulnerability/), [Japanese](https://ja.wordpress.org/plugins/wpvulnerability/), [Portuguese (Brazil)](https://br.wordpress.org/plugins/wpvulnerability/), [Portuguese (Portugal)](https://pt.wordpress.org/plugins/wpvulnerability/), [Russian](https://ru.wordpress.org/plugins/wpvulnerability/), [Spanish (Chile)](https://cl.wordpress.org/plugins/wpvulnerability/), [Spanish (Colombia)](https://es-co.wordpress.org/plugins/wpvulnerability/), [Spanish (Ecuador)](https://es-ec.wordpress.org/plugins/wpvulnerability/), [Spanish (Spain)](https://es.wordpress.org/plugins/wpvulnerability/), and [Spanish (Venezuela)](https://ve.wordpress.org/plugins/wpvulnerability/). * [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/wpvulnerability) * Tags * [security](https://tg.wordpress.org/plugins/tags/security/)[site health](https://tg.wordpress.org/plugins/tags/site-health/) [vulnerability](https://tg.wordpress.org/plugins/tags/vulnerability/) * [Advanced View](https://tg.wordpress.org/plugins/wpvulnerability/advanced/) ## Ratings 5 out of 5 stars. * [ 20 5-star reviews ](https://wordpress.org/support/plugin/wpvulnerability/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/wpvulnerability/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/wpvulnerability/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/wpvulnerability/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/wpvulnerability/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/wpvulnerability/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/wpvulnerability/reviews/) ## Contributors * [ ROBOTSTXT.es ](https://profiles.wordpress.org/robotstxt/) * [ Javier Casares ](https://profiles.wordpress.org/javiercasares/) * [ David Perez ](https://profiles.wordpress.org/davidperez/) * [ Lucas Bonomo ](https://profiles.wordpress.org/lbonomo/) * [ Alex Lion (阿力獅) ](https://profiles.wordpress.org/alexclassroom/) ## Support Issues resolved in last two months: 6 out of 6 [View support forum](https://wordpress.org/support/plugin/wpvulnerability/)