WordPress Vulnerability Scanner

This package is a framework for finding and fixing vulnerabilities in a WordPress installation.

It was created as a means to be able find and fix vulnerabilities in WordPress without having to rely on WordPress plugins, as if a WordPress installation is infected with some kind of malware, the WordPress plugin may not even be accessible by the administrator.

The package can be run from the command line shell using the PHP CLI version.

There is a core class that can call add-on classes that are specialized in finding and fixing different types of vulnerabilities.

The fix.php script calls the main class to find and fix vulnerability.

The options.php configuration script defines an array that with option values that should include the WordPress database access credentials, a dry run option that when set to true allows to tell the main class to scan the WordPress installation to just tell if there are any vulnerabilities without fixing them.

Additional options may be passed per each type of vulnerability that was found, so the respective vulnerability handler class can use the configured values to fix the vulnerability.

The package may include additional vulnerability handler classes that can be provided eventually by third-party developers. Any additional vulnerability handler classes may be configured using the wordpress_vulnerabilities.json configuration file.

If you would like to contribute with additional vulnerability handler classes, please mail mlemos@acm.org to get contribution instructions.