CRA Vuln Notify
| 开发者 | macroncode |
|---|---|
| 更新时间 | 2026年9月2日 20:52 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
The EU Cyber Resilience Act (CRA) requires those who develop or manage software — including small agencies that run WordPress sites for clients — to notify known vulnerabilities in the components they use within tight deadlines, if those vulnerabilities are actively exploited. CRA Vuln Notify automates the most time-consuming part of this obligation: knowing a vulnerability exists, understanding how urgent it is, and never missing a deadline.
How it works
- Scans all installed plugins and themes every day (or on demand, with one click from the dashboard), checking their versions against a known vulnerability database.
- Classifies each vulnerability found by severity — critical, high, medium, low — and checks whether it is actively exploited.
- Starts the CRA timeline for actively exploited vulnerabilities: preliminary notification within 24 hours of discovery, full notification within 72 hours, final notification upon closure — with countdowns always visible in the dashboard.
- Alerts you by email and with a banner in wp-admin as soon as a critical vulnerability appears, so you don't have to check the dashboard every day to notice it.
- Generates a draft notification document, ready to adapt for submission to the competent authority (national CSIRT / ENISA) or to end users, with a full log exportable to CSV for audit purposes.
安装:
- Upload the
cra-vuln-notifyfolder to/wp-content/plugins/. - Activate the plugin from the WordPress "Plugins" menu.
- Go to "CRA Vuln Notify" > "Settings", choose a vulnerability provider (WPScan or Patchstack) and enter the corresponding API key.
- The plugin will run an automatic daily scan; you can also trigger a manual scan from the dashboard.
常见问题:
Which vulnerability database is used?
By default the plugin uses the WPScan Vulnerability Database API, which offers a free plan with a quota of 25 requests/day (enough for sites with a small number of plugins/themes; on larger installations a full scan may take more than one day to complete). You can switch to Patchstack instead, a paid provider without this limit. In both cases you need an API key that you register yourself with the chosen provider.
Does the plugin automatically send notifications to authorities?
No. The plugin generates the notification document with the required fields and keeps track of it in the log, but actually sending it to the competent authorities remains a manual action by the user, unless future integrations change this.
更新日志:
0.1.0
- Initial plugin structure: activation, database table creation, default options.
- Installed plugin/theme scanning with a pluggable vulnerability provider (WPScan default, Patchstack paid), daily cron, caching/rate-limiting.
- Severity classification (CVSS) and calculation/maintenance of the CRA notification timeline (24h/72h/final) for actively exploited vulnerabilities.
- Admin dashboard (Components at risk, Notifications, Settings) with manual "actively exploited" flagging, "Mark resolved" action, admin notice for critical vulnerabilities.
- Notification document generation (fillable text draft, downloadable as .txt) and CSV export of the notification log for audit purposes.
- Automatic email to the configured address when a new actively exploited vulnerability is detected; full cleanup of tables/options on uninstall.
- English as the source language, fully translation-ready (translations to be managed via translate.wordpress.org).