Vulnity Security
| 开发者 | manuelgalan |
|---|---|
| 更新时间 | 2026年3月25日 03:40 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Vulnity Security brings enterprise-grade threat detection to WordPress. It connects your site to Vulnity's SIEM platform, correlates events, and alerts you before issues become incidents.
Features
- Real-time security event collection and forwarding to Vulnity SIEM.
- Dashboard widgets that highlight critical findings and remediation steps.
- Scheduled security scans for core files, plugins, and themes.
- Centralized logging compatible with major SOC workflows.
euxnoekqasvzwfcbybkg.supabase.co, base URL https://euxnoekqasvzwfcbybkg.supabase.co/functions/v1) to power SIEM alerts, inventory sync, and mitigation updates.
- What the service is and what it is used for:
- Vulnity SIEM API for pairing/unpairing, heartbeat checks, sending alerts, testing connectivity, syncing inventory, and receiving mitigation policies.
- Endpoints used:
/pair-plugin,/unpair-plugin(pairing and disconnecting the site)./heartbeat(periodic health check)./connection-test(manual connection test)./scan-site-info(inventory sync)./generic-alert,/brute-force-alert,/file-security-alert,/manage-user,/user-management-alert,/permission-change-alert,/file-editor-alert,/plugin-change-alert,/theme-change-alert,/core-update-alert,/suspicious-query-alert,/scanner-detected-alert(security alerts)./mitigation-config,/mitigation-update(mitigation policy sync and block/unblock updates).- What data is sent and when:
- Pairing/unpairing: site ID, pair code, plugin/WordPress/PHP versions, and timestamp when pairing or disconnecting occurs.
- Heartbeat: site ID, URLs, site metadata (name, language, timezone, theme), and runtime info (plugin/WordPress/PHP versions, latency) on a scheduled interval.
- Alerts: site ID, alert type/severity, timestamps, and event details (such as IP address, user/action metadata, or file change context) whenever a security event is detected.
- Inventory sync: site inventory details (installed plugins/themes/core metadata) when inventory sync runs.
- Mitigation: site ID, block/unblock actions, IP address, reason, duration, and rule metadata when mitigation rules are synced or enforcement actions occur.
- Why the data is sent:
- To associate the site with your Vulnity account, deliver security alerts to the SIEM, validate connectivity, synchronize inventory and mitigation policies, and keep firewall enforcement consistent.
- Policies: See the Vulnity Terms of Service and Privacy Policy for details on how data is handled.
安装:
- Upload the plugin files to the
/wp-content/plugins/vulnitydirectory or install from the WordPress plugin repository. - Activate the plugin through the Plugins screen in WordPress.
- Navigate to Vulnity > Settings, enter your Vulnity SIEM credentials, and save.
- (Optional) Enable scheduled scans on the Monitoring tab to receive weekly reports.
屏幕截图:
常见问题:
Do I need a Vulnity SIEM subscription?
Yes. The plugin requires an active Vulnity SIEM account to collect and analyze events.
Will the plugin slow down my site?
No. Event collection runs asynchronously and offloads processing to the Vulnity cloud platform.
Can I disable certain alerts?
Absolutely. Use the Alert Policies section within the plugin settings to mute or reclassify events.
更新日志:
1.2.2
- Fixed anti-collapse dedup system blocking subsequent auto-update state toggle events due to identical hash.
- Fixed wrong authentication headers for
/real-time-alertsendpoint (now uses HMAC-SHA256 signature instead of token). - Fixed missing
remediationfield in auto-update state events sent to the SIEM. - Fixed
version_oldnot captured in auto-update events; now recorded viaupgrader_pre_installhook before files are replaced. - Fixed auto-update trigger running on disable; updates now only fire for newly enabled component types.
- Fixed auto-update event detection using
instanceof WP_Automatic_Updaterinstead ofwp_doing_cron()for broader compatibility. - Fixed single-file plugin slug resolving to
.(e.g. hello-dolly) in update event payloads. - Added
triggered_byfield to update events:siem_manual,siem_auto_update, orwp_auto_updater. - Auto-update toggles in the admin panel are now read-only; changes must be made from the SIEM.
- Replaced
parse_url()withwp_parse_url()for WordPress coding standards compliance.
- Plugin Check compatibility improvements for filesystem and nonce-related warnings.
- Runtime validation improvements for scanner detection, file editor monitoring, and firewall state serialization.
- Fixed login URL rename validation against existing pages/posts and reserved WordPress routes.
- Fixed uninstall cron cleanup to use
wp_unschedule_hook()for complete removal. - Fixed heartbeat, mitigation sync, and alert buffer crons not cancelled on plugin disconnect.
- Send whitelist IPs (user public IP + localhost) to the SIEM during pairing so the whitelist persists after synchronization.
- Fixed Nginx warning notice appearing repeatedly on every admin page load; it now displays only once.
- Improved notice format: each protected path is shown on its own line for better readability.
- Added link to solution documentation for Nginx .htaccess compatibility.
- Fixed deactivation not clearing all cron jobs (4 missing hooks, plus events re-scheduled by late-firing alert hooks).
- Added
final_deactivation_cleanupat priority 9999 to ensure complete cron and .htaccess cleanup after all hooks fire. - Replaced
wp_clear_scheduled_hookwithwp_unschedule_hookto clear single events with arguments. - Added native PHP fallback for .htaccess marker removal when WP_Filesystem is unavailable.
- Fixed Plugin Check error: replaced direct
is_writable()withvulnity_path_is_writable()andWP_Filesystem_Direct.
- Fix uninstall multisite cleanup query when
sitemetatable is not available to prevent SQL warnings in debug.log.
- Ensure uninstall removes Vulnity firewall/log folders recursively so no plugin-owned folders are left behind.
- Ensure uninstall removes Vulnity firewall/log folders even when permissions are restrictive by attempting safe chmod before cleanup.
- Added a dedicated Vulnity log with line-based rotation and safe fallbacks when uploads are not writable.
- Added admin warning when firewall storage cannot be written, with clear remediation guidance.
- Expanded uninstall cleanup to remove Vulnity log files and firewall artifacts across fallback paths.
- Fixed deactivation cleanup so Vulnity hardening marker blocks are removed fully from
.htaccesswithout modifying user-defined rules. - Improved deactivation safety in shared hosting environments with conservative, marker-only rollback behavior.
- Improved admin UI consistency across Dashboard, Synchronization, Mitigation, Hardening, and Setup screens.
- Hardened plugin lifecycle behavior for shared hosting compatibility and safer deactivation/uninstall flows.
- Added conservative server integration safeguards to reduce side effects in Apache/Nginx environments.
- Version bump to 1.0.5.
- Version bump to 1.0.4.
- Standardized admin asset enqueues and AJAX URL localization for compliant loading.
- Hardened nonce and capability checks across alerts and admin handlers.
- Improved path resolution using WordPress APIs for non-default installs.
- Documented external Supabase services used for alerts and mitigation updates.
- Initial release.