6 releases 6 tags

RSS feed

• 5.1.0 31f7e97d39

  Compare

  v5.1.0 Stable

  javier released this 2026-07-09 06:21:27 +00:00 | 3 commits to main since this release

  [5.1.0] - 2026-07-08

  Security

  • wpvulnerability_validate_shell_command() now uses exact in_array() match instead of stripos() substring matching for the shell-command allowlist (defense-in-depth).
  • wpvulnerability_detect_php(), wpvulnerability_detect_curl(), and wpvulnerability_detect_webserver() now route through wpvulnerability_safe_shell_exec(), so every software-detection shell call is validated and recorded in the Shell Execution Audit Log. Previously these called shell_exec() directly, bypassing the wrapper and the audit log. As a side effect this also fixes nginx/angie version detection: escapeshellcmd() was escaping the 2>&1 redirect, so stderr (where nginx prints its version) was never captured.

  Fixed

  • Multisite uninstall fatal error: Uncaught Error: Undefined constant "WPVULNERABILITY_PLUGIN_BASE" when "Delete all plugin data on uninstall" was enabled. uninstall.php now defines the constant before loading wpvulnerability-run.php.
  • WPVULNERABILITY_HIDE_* constants now stop shell_exec detection for hidden components during scheduled scans and in the admin "Software Detection Methods" panel. Previously they only hid the results from the UI, so the audit log kept filling with "command not found" entries for components the administrator had explicitly deactivated.
  • wpvulnerability_detect_webserver() no longer shell-probes a hidden web server via the sibling path: WPVULNERABILITY_HIDE_NGINX and WPVULNERABILITY_HIDE_APACHE now fully isolate the hidden server.
  • Multisite cron requests on non-main subsites no longer load all plugin module files. No WPVulnerability cron events are scheduled on subsites, so the extra loading was wasted work.
  • LiteSpeed / OpenLiteSpeed / Caddy shell detection in the WP_DEBUG diagnostic panel now works: the commands no longer use 2>/dev/null (which the shell-command validator rejected), caddy was added to the allowlist, and which output is validated as a real path so "command not found" messages are not mistaken for a detection.

  Changed

  • Network: true added to the plugin header to declare network-aware multisite behaviour.
  • Removed the unused $plugin_status parameter from wpvulnerability_plugin_info_after(); the PHPCS suite now passes with zero warnings.
  • Multisite network dashboard: the "Site Health" footer link pointed to wp-admin/network/site-health.php, which does not exist (Site Health is a per-site screen). It now links to the main site's wp-admin/site-health.php.

  Downloads

  • wpvulnerability-5.1.0.zip
    3 downloads · 2026-07-09 06:21:16 +00:00 · 1.7 MiB