WPVulnerability

All commands support the --format option to specify the output format:

• --format=table : Displays the results in a table format (default).
• --format=json : Displays the results in JSON format.

Need help?

• wp wpvulnerability --help : Displays help information for WPVulnerability commands.
• wp wpvulnerability [command] --help : Displays help information for a WPVulnerability command.

REST API

The WPVulnerability plugin provides several REST API endpoints to fetch vulnerability information for different components of your WordPress site.

• Core: /wpvulnerability/v1/core
• Plugins: /wpvulnerability/v1/plugins
• Themes: /wpvulnerability/v1/themes
• PHP: /wpvulnerability/v1/php
• Apache HTTPD: /wpvulnerability/v1/apache
• nginx: /wpvulnerability/v1/nginx
• MariaDB: /wpvulnerability/v1/mariadb
• MySQL: /wpvulnerability/v1/mysql
• ImageMagick: /wpvulnerability/v1/imagemagick
• curl: /wpvulnerability/v1/curl
• memcached: /wpvulnerability/v1/memcached
• Redis: /wpvulnerability/v1/redis
• SQLite: /wpvulnerability/v1/sqlite

The WPVulnerability REST API uses Application Passwords for authentication. You need to include a valid Application Password in the Authorization header of your requests.

Example Request with Authentication

curl -X GET https://example.com/wp-json/wpvulnerability/v1/plugins -u username:application_password

Replace username with your WordPress username and application_password with your Application Password .

Extra Configurations

“From:” mail (since: 3.2.2)

If, for some reason, you need the emails sent by the plugin to have a From different from the site administrator, you can change it from the wp-config.php by adding a constant:

define( 'WPVULNERABILITY_MAIL', 'sender@example.com' );

If the constant is active, it will be visible in the configuration screen.

Force hiding checks (since: 4.1.0)

If you want to always hide a specific component, you can define a constant in wp-config.php . When set to true , the option will be checked automatically in the settings screen and the related analysis will be skipped.

Example:

define( 'WPVULNERABILITY_HIDE_APACHE', true );

Available constants: WPVULNERABILITY_HIDE_CORE , WPVULNERABILITY_HIDE_PLUGINS , WPVULNERABILITY_HIDE_THEMES , WPVULNERABILITY_HIDE_PHP , WPVULNERABILITY_HIDE_APACHE , WPVULNERABILITY_HIDE_NGINX , WPVULNERABILITY_HIDE_MARIADB , WPVULNERABILITY_HIDE_MYSQL , WPVULNERABILITY_HIDE_IMAGEMAGICK , WPVULNERABILITY_HIDE_CURL , WPVULNERABILITY_HIDE_MEMCACHED , WPVULNERABILITY_HIDE_REDIS , WPVULNERABILITY_HIDE_SQLITE .

Cache duration (since: 4.1.0)

By default, data from the API is cached for 12 hours. To change this, define WPVULNERABILITY_CACHE_HOURS in wp-config.php with one of 1 , 6 , 12 or 24 . This value overrides the setting screen and WP-CLI command.

define( 'WPVULNERABILITY_CACHE_HOURS', 24 );

Log rotation (since: 4.2.0)

WPVulnerability stores the most recent API responses so you can review recent calls from the new log tab. Define WPVULNERABILITY_LOG_RETENTION_DAYS in wp-config.php to control how many days of entries are preserved. Supported values are 0 , 1 , 7 , 14 or 28 ; using 0 disables logging entirely.

define( 'WPVULNERABILITY_LOG_RETENTION_DAYS', 14 );

When the constant is present its value is enforced in the settings UI and through WP-CLI, ensuring consistent log rotation across environments.

Security configuration (since: 4.3.0)

WPVulnerability uses a hybrid detection approach for server software (ImageMagick, Redis, Memcached, SQLite): PHP extensions first (most secure), then shell commands as fallback (most accurate). You can control this behavior using security configuration constants in wp-config.php .

Global disable of shell commands:

define( 'WPVULNERABILITY_DISABLE_SHELL_EXEC', true );

Completely disables shell command usage. Falls back to PHP extensions only. Use for maximum security when accuracy loss is acceptable.

Security mode (standard/strict/disabled):

define( 'WPVULNERABILITY_SECURITY_MODE', 'strict' );

• standard – Hybrid detection: PHP extensions first, shell commands fallback (default, best accuracy)
• strict – PHP extensions only, no shell commands (high security, lower accuracy)
• disabled – No software detection at all (maximum security)

Component whitelist:

define( 'WPVULNERABILITY_SHELL_EXEC_WHITELIST', 'imagemagick,redis' );

Allows shell commands only for specified components. Available components: imagemagick , redis , memcached , sqlite . Use for granular control.

Examples:

Maximum security (no shell commands):

define( 'WPVULNERABILITY_SECURITY_MODE', 'strict' );

Only allow ImageMagick shell detection:

define( 'WPVULNERABILITY_SHELL_EXEC_WHITELIST', 'imagemagick' );

Complete disable:

define( 'WPVULNERABILITY_DISABLE_SHELL_EXEC', true );

All shell commands are hardcoded and validated – no user input is involved. Commands are logged for security auditing.

Compatibility

• WordPress: 4.7 – 7.1
• PHP: 7.0 – 8.5
• WP-CLI: 2.3.0 – 2.12.0

Security

This plugin adheres to the following security measures and review protocols for each version:

• WordPress Plugin Handbook
• WordPress Plugin Security
• WordPress APIs Security
• WordPress Coding Standards
• Plugin Check (PCP)

Privacy

• This plugin or the WordPress Vulnerability Database API does not collect any information about your site, your identity, the plugins, themes or content the site has.

Vulnerabilities

• A security vulnerability was found and fixed in version 4.2.2.1. All previous versions (3.3.0 – 4.2.1) are affected. Please update to version 4.2.2.1 or later.

Found a security vulnerability? Please report it to us privately at ROBOTSTXT .

Contributors

You can contribute to this plugin at the WPVulnerability repository .