WPVulnerability

変更履歴

[5.1.2] – 2026-08-07

Fixed

• Missing load_plugin_textdomain() call caused a “Translation loading for the wpvulnerability domain was triggered too early” _doing_it_wrong() notice on WordPress 6.7+. The textdomain is now explicitly loaded on the init hook.

Added

• WordPress Playground blueprint (blueprint.json) with pre-installed vulnerable plugins and a theme for quick testing.

Changed

• Security vulnerability reporting link updated to ROBOTSTXT.
• Contributor repository link updated to git.robotstxt.es/ROBOTSTXT/wpvulnerability.
• The readme.txt Changelog section now shows only the latest 3 versions; the full history remains in changelog.txt.

互換性

• WordPress: 5.6 – 7.1
• PHP: 7.0 – 8.5
• WP-CLI: 2.3.0 – 2.12.0

Tests

• PHP Coding Standards: 3.13.5
• WordPress Coding Standards: 3.3.0
• PHPStan: 2.1.55 (level 9, 0 errors)
• PHPUnit: 9.6.34 (25 tests)

[5.1.1] – 2026-07-09

Fixed

• Site Health: the memcached, Redis, and SQLite vulnerability tests always returned “Invalid software type” because those components were missing from the software list. They now run correctly.
• “Send test email” failed when no email recipients were configured: the forced-test path added the admin email but the send gate used a flag computed before the override. The test email now sends.
• “Run notification now” reported failure when only webhook channels (Slack/Teams/Discord/Telegram) were enabled and email was disabled. The notification result now reflects whether any channel delivered successfully.
• Weekly notification cron events were never auto-scheduled, because the weekly cron schedule was registered only at init while the on-load scheduling runs earlier. The weekly/daily schedule registration moved to the always-loaded scheduler so weekly notifications schedule correctly.
• Deactivation deleted the per-component analysis settings (wpvulnerability-analyze), so deactivating and reactivating reset which components were hidden. Analysis settings are now preserved on deactivation (only uninstall removes them).
• The debug “Cron Status” panel always showed the notification event as “not scheduled” because it checked the wrong hook name (wpvulnerability_send_notification instead of wpvulnerability_notification).
• The debug “last run” timestamp was always empty because it read a wpvulnerability-logs option that is never written; it now reads the most recent API log entry.
• Redis detection called close() twice on the success path (once in the try block, once in finally); the redundant close was removed.
• The single-site vulnerable-themes count was hardcoded to 0 instead of reading the stored option.

Changed

• Single-site email recipient sanitization now uses is_email() for strict validation, matching the multisite behaviour.
• Removed a redundant nonce field from the single-site “Reset Plugin” form (the form only submits the full-reset action).
• Removed dead code: the unused wpvulnerability_sanitize_messages callback and its setting registration, and an unused $tools_action variable in the multisite admin.

互換性

• WordPress: 5.6 – 7.1
• PHP: 7.0 – 8.5
• WP-CLI: 2.3.0 – 2.12.0

Tests

• PHP Coding Standards: 3.13.5
• WordPress Coding Standards: 3.3.0
• PHPStan: 2.1.55 (level 9, 0 errors)
• PHPUnit: 9.6.34 (25 tests)

[5.1.0] – 2026-07-08

セキュリティ

• wpvulnerability_validate_shell_command() now uses exact in_array() match instead of stripos() substring matching for the shell-command allowlist (defense-in-depth).
• wpvulnerability_detect_php(), wpvulnerability_detect_curl(), and wpvulnerability_detect_webserver() now route through wpvulnerability_safe_shell_exec(), so every software-detection shell call is validated and recorded in the Shell Execution Audit Log. Previously these called shell_exec() directly, bypassing the wrapper and the audit log. As a side effect this also fixes nginx/angie version detection: escapeshellcmd() was escaping the 2>&1 redirect, so stderr (where nginx prints its version) was never captured.

Fixed

• Multisite uninstall fatal error: Uncaught Error: Undefined constant "WPVULNERABILITY_PLUGIN_BASE" when “Delete all plugin data on uninstall” was enabled. uninstall.php now defines the constant before loading wpvulnerability-run.php.
• WPVULNERABILITY_HIDE_* constants now stop shell_exec detection for hidden components during scheduled scans and in the admin “Software Detection Methods” panel. Previously they only hid the results from the UI, so the audit log kept filling with “command not found” entries for components the administrator had explicitly deactivated.
• wpvulnerability_detect_webserver() no longer shell-probes a hidden web server via the sibling path: WPVULNERABILITY_HIDE_NGINX and WPVULNERABILITY_HIDE_APACHE now fully isolate the hidden server.
• Multisite cron requests on non-main subsites no longer load all plugin module files. No WPVulnerability cron events are scheduled on subsites, so the extra loading was wasted work.
• LiteSpeed / OpenLiteSpeed / Caddy shell detection in the WP_DEBUG diagnostic panel now works: the commands no longer use 2>/dev/null (which the shell-command validator rejected), caddy was added to the allowlist, and which output is validated as a real path so “command not found” messages are not mistaken for a detection.

Changed

• Network: true added to the plugin header to declare network-aware multisite behaviour.
• Removed the unused $plugin_status parameter from wpvulnerability_plugin_info_after(); the PHPCS suite now passes with zero warnings.
• Multisite network dashboard: the “Site Health” footer link pointed to wp-admin/network/site-health.php, which does not exist (Site Health is a per-site screen). It now links to the main site’s wp-admin/site-health.php.

互換性

• WordPress: 5.6 – 7.1
• PHP: 7.0 – 8.5
• WP-CLI: 2.3.0 – 2.12.0

Tests

• PHP Coding Standards: 3.13.5
• WordPress Coding Standards: 3.3.0
• PHPStan: 2.1.55 (level 9, 0 errors)
• PHPUnit: 9.6.34 (18 tests)

Previous versions

If you want to see the full changelog, visit the changelog.txt file.