Download the PHP package 10up/wpcli-vulnerability-scanner without Composer

WP-CLI Vulnerability Scanner

Check WordPress core, installed plugins and themes for vulnerabilities.

Installation

Global command, automatically

It can be installed as a wp-cli package via git repo which is the most preferred way to install.

API Access

WP-CLI Vulnerability Scanner works with WPScan, Patchstack and Wordfence Intelligence to check reported vulnerabilities; you can choose any one of these three to use. You will need to add a constant in your wp-config.php to decide which API service you want to use (by default WPScan API will be used).

To use WPScan API:

To use Patchstack API:

To use Wordfence Intelligence API:

Note: Authentication is not required for the Wordfence Intelligence Vulnerability API ( https://www.wordfence.com/wti-community-edition-terms-and-conditions/ ). VULN_API_TOKEN is not required if using Wordfence as your provider.

For WPScan and Patchstack you will need to register for a user account and supply an API token from the chosen API service. Once you have acquired the token, you can add it as a constant in wp-config.php as follows:

Global command, manually

Clone this repo, checkout to stable branch and require wpcli-vulnerability-scanner.php from wp-cli config. E.g. in ~/.wp-cli/config.yml [other config locations]

Standard plugin

This repo can be installed as a regular plugin. There is no UI, but the command will become available.

After plugin installation, you can verify the command is in place with wp help vuln

Usage

• Options:
• --test Load test data
• --format=<format> Accepted values: table, csv, json, count, ids, yaml. Default: table
• --nagios Output for nagios

• --reference includes the reference link of the vulnerability within the output

• Options:
• --format=<format> Accepted values: table, csv, json, count, ids, yaml. Default: table
• --nagios Output for nagios

• --reference includes the reference link of the vulnerability within the output

• Options:
• --test Load test data
• --porcelain Only print slugs of vulnerable plugins with updates
• --format=<format> Accepted values: table, csv, json, count, ids, yaml. Default: table
• --nagios Output for nagios

• --reference includes the reference link of the vulnerability within the output

• Options:
• --test Load test data
• --porcelain Only print slugs of vulnerable theme with updates
• --format=<format> Accepted values: table, csv, json, count, ids, yaml. Default: table
• --nagios Output for nagios
• --reference includes the reference link of the vulnerability within the output

Example output

Checking WordPress core, plugins and themes for reported vulnerabilities:

Using the JSON format:

Checking any given theme:

Using the JSON format:

Example usage

Basic

Will simply error out if there are no slugs returned by the plugin-status command. Can suppress the output by appending &> /dev/null

Scheduled/Cron

0 0 * * * is everyday at midnight. For assistance creating an alternate schedule, check out http://crontab.guru/. For example, 0 0 * * 1,4 runs at midnight every Monday and Thursday.

With email notifications

Included is a sample bash script, includes/vuln.sh. This can be customized and used in a cron job so that you can be alerted when vulnerabilities are found.

• WPCLIPATH should be the full path to your wp command. The script will attempt to discover this automatically if the given filename does not exist

• RECIPIENT should be an email address which will receive the notifications
• SUBJECT is the email subject

This readme does not discuss configuring the mail command on your server. To run a simple test, try

Nagios

wp vuln plugin-status --nagios will give output for Nagios monitoring.

Check uninstalled themes and plugins

Check a specific version of a theme or plugin. Example:

Or check several at once (cannot accept versions)

Running Tests

Prerequisites:

Must have environment variables for VULN_API_PROVIDER and VULN_API_TOKEN

To run tests against WPScan API:

To run tests against Patchstack API:

To run tests against Wordfence Intelligence API, VULN_API_TOKEN is not required:

Install dependencies

Note: Not uncommon for composer to run out of memory, you may need to take steps to free up memory on your end

Run tests

WPScan API

PatchStack API

Wordfence API

Support Level

Active: 10up is actively working on this, and we expect to continue work for the foreseeable future including keeping tested up to the most recent version of WordPress. Bug reports, feature requests, questions, and pull requests are welcome.

Changelog

A complete listing of all notable changes to WP-CLI Vulnerability Scanner are documented in CHANGELOG.md.

Contributing

Please read CODE_OF_CONDUCT.md for details on our code of conduct, CONTRIBUTING.md for details on the process for submitting pull requests to us, and CREDITS.md for a listing of maintainers of, contributors to, and libraries used by WP-CLI Vulnerability Scanner.

Like what you see?