WPSniffer v0.1.1

Install or upgrade:

pip install --upgrade wpsniffer==0.1.1

The wheel and source archive below are the same files published to PyPI.

Fixed

• An expired YARA Forge cache is used again when the download fails; it was
  deleted before the offline fallback could read it.
• Scans using the spawn or forkserver start method (macOS, Windows,
  Python 3.14+ on Linux) no longer run workers with an empty rule set when
  the rules were not pre-compiled.
• Setting rules in wpsniffer.ini no longer crashes with a TypeError.
• Path sets no longer report parents of added paths, or one-character
  relative paths, as members.
• --quiet now suppresses the welcome banner.
• scanner.Options no longer enables profiling by default.

Security

• SMTP connections now verify the server certificate and hostname in both
  smtps and starttls modes. Previously any certificate was accepted, so a
  network attacker could capture the SMTP credentials and the scan report.
  Relays with a private CA need it in the system trust store or in
  SSL_CERT_FILE.
• A file reached through a symlink is now filtered by the link's own name,
  which is what web servers execute: a shell.php link to a cache.dat
  webshell was skipped by the default scan.
• The default file filter now includes .phar and .pht, which stock Apache
  configurations execute as PHP.

WPSniffer v0.1.0

Install or upgrade:

pip install --upgrade wpsniffer==0.1.0

The wheel and source archive below are the same files published to PyPI.