Vulnerability alerts

Vulnerability alerts warns when the installed WordPress, a plugin or a theme has a known security vulnerability, and names the version that fixes it. It is meant for sites without Wordfence, which does this job itself. The data comes from Wordfence Intelligence, signed and served by the SafeHouse update host.

Urgent findings show on every wp-admin screen, all findings are in Tools → Site Health and on the SafeHouse settings page, and the alert recipients get an e-mail when new ones appear.

Module ID	vulnerabilities
Default	On
Available	Unless Wordfence is active. SafeHouse then shows "Wordfence is active and already warns about vulnerable plugins, themes and WordPress versions."
WP-CLI	wp shouse vulnerabilities (only while the module runs)
Since	0.1.0

How it works

What is checked

• the installed WordPress version
• every installed plugin, active or not
• every installed theme, active or not, by its folder name

SafeHouse itself is not checked. A plugin is known by the slug WordPress's own update check found for it, otherwise by its folder name.

A version is affected when it falls in one of the vulnerability's affected version ranges. Each end of a range is included or excluded as the data says, and an open end matches every version, the same rule Wordfence uses.

What counts as urgent

A finding is urgent when:

• its CVSS score is 7.0 or higher, or
• the data lists no fixed version.

Urgent findings come first, then the rest, each group sorted by CVSS score from high to low.

Where the data comes from

Design House builds the data from the Wordfence Intelligence vulnerability feed. Every record that has affected version ranges goes in; records Wordfence marks as informational are left out. The files are published on updates.designhouse.me, the same host that serves SafeHouse updates.

How the data is signed and split

The data is split into 256 shard files, 00.json to ff.json. A plugin, theme or WordPress itself goes into the shard named by the first two hexadecimal characters of the MD5 hash of its key. For example, plugin:akismet is in shard b8 and core:wordpress in shard 33. Each shard holds about 1/256 of all the software in the data.

Next to the shards are two files:

• index.json: the format number, the time the data was built, the attribution line, and the SHA-256 hash of each of the 256 shards
• index.json.sig: an Ed25519 signature of index.json, in base64

Before SafeHouse uses anything, it checks that:

1. the signature is valid for the public key built into SafeHouse for vulnerability data, a6vBsYaycKRtBA7v4cySBDY+SQnezuUPXgsjBriP64M=
2. the index has format 1 and exactly 256 shards, each with a valid name and SHA-256 hash
3. every shard it downloads has exactly the hash the signed index lists

The vulnerability data key is separate from the key that signs SafeHouse releases, and the updater never trusts it. Whoever holds it could fake or hide warnings, but could not ship code to your site. See Signed updates.

SafeHouse also limits the sizes it accepts (256 KB for the index, 1 KB for the signature, 4 MB for a shard), waits at most 15 seconds per file, follows at most two redirects, and drops any entry that is not well formed.

What the site sends and does not send

A download asks for index.json, index.json.sig and only the shards that hold the site's installed software. A shard is downloaded again only when its hash in the signed index changed, or when newly installed software falls into it.

The site never sends its list of plugins and themes, their versions or its findings. The update host sees the requests: the server's IP address, WordPress's default user agent (which includes the site address) and the shard names asked for. A shard name stands for about 1/256 of all the software in the data, not for one plugin. See Data and privacy.

When it downloads

Every hour, on WP-Cron, SafeHouse downloads the data when:

• the last attempt is more than 6 hours old, or
• the last attempt failed and is more than an hour old, or
• a plugin or theme was added or removed since then.

The first download happens at the first hourly run after the module starts, or when you select Check now.

Between downloads, SafeHouse matches the installed versions against the stored data:

• right after WordPress updates software, activates, deactivates or deletes a plugin, switches the theme or updates core, so an update clears its warning at once
• at every hourly run, which picks up versions changed outside WordPress, for example over FTP or by a git deploy

Where findings appear

Admin notice

Urgent findings show in a red notice at the top of every wp-admin screen, for users who can update plugins or WordPress.

The notice lists up to five urgent findings under the heading "Security vulnerability in installed software". Each line ends with a Details link to the record on wordfence.com, which opens in a new tab. Below the list are the Go to updates button and the All findings link to the SafeHouse settings page.

The notice cannot be dismissed. It goes away when the software is updated past the vulnerable versions or removed.

Each finding reads like one of these:

Example Plugin 2.4.1 (CVSS 8.8): Unauthenticated Arbitrary File Upload. Update to 2.4.2 or later.
Example Theme 1.0.3: Stored Cross-Site Scripting. No fixed version yet: deactivate it if you can do without it.

When the data lists several fixed versions, they are joined with " / ". The CVSS part is missing when the data has no score.

Details panel

On SafeHouse → Modules → Vulnerability alerts → Details: "Last check:" with the date and time, then a table of all findings with the columns Software (name and installed version), Vulnerability (a badge with the CVSS score, or with critical or warning when there is no score, then the title and Details) and Fixed in (the fixed versions, or "no fix yet"). Without findings it says "No known vulnerabilities in installed software." The attribution line from the data is shown below.

Site Health

Tools → Site Health has the test "SafeHouse vulnerability alerts":

Result	Status	When
"Installed software has known vulnerabilities"	Critical with an urgent finding, recommended otherwise	Lists every finding, urgent or not.
"Vulnerability data has not been downloaded yet"	Recommended	No data yet; shows the last error, if any.
"No known vulnerabilities in installed software"	Good	Data is there and nothing matches.

The result includes the attribution line and the Go to updates link.

E-mail

SafeHouse decides about e-mail after every download attempt: the hourly one when it is due, Check now, wp shouse vulnerabilities --refresh, and the first wp shouse vulnerabilities on a site that was never checked. This happens after failed attempts too, using the stored data.

It compares the current findings with the set it saved at the previous attempt. Findings that were not in that set, urgent or not, go out together in one e-mail:

Subject: [SafeHouse] SITE NAME: 2 known vulnerabilities in installed software

- Example Plugin 2.4.1 (CVSS 8.8): Unauthenticated Arbitrary File Upload. Update to 2.4.2 or later.
- Example Theme 1.0.3: Stored Cross-Site Scripting. No fixed version yet: deactivate it if you can do without it.

Vulnerability data: Wordfence Intelligence.

The attribution line can carry copyright notices from the Wordfence data. SafeHouse also writes vulnerability_found (critical) to the activity log. Every attempt, with or without new findings, then replaces the saved set with the current findings.

This has consequences you may notice:

• The first download e-mails every finding the site has at that moment.
• A finding that is gone at one attempt and back at a later one is e-mailed again, for example after a plugin is removed and installed again.
• A finding caused by a version change, such as a plugin rolled back to an older version, shows in wp-admin at once or within the hour, but is e-mailed only at the next download, which comes about every 6 hours.
• Findings that go away are not e-mailed.

Settings

Vulnerability alerts has no settings. While it runs, Details shows the findings described above and the Check now button. Before the first download it says "Not checked yet. Use "Check now" or wait for the next hourly run."

Check now

1. Go to SafeHouse → Modules → Vulnerability alerts and select Details.

2. Select Check now.

   SafeHouse downloads the data and shows "Vulnerability data updated." or "Could not download vulnerability data:" followed by the reason. New findings are e-mailed as described above.

List findings with WP-CLI

Show the findings from the stored data:

wp shouse vulnerabilities

Download the data first, which also sends the e-mail for new findings:

wp shouse vulnerabilities --refresh

The columns are software (such as plugin:akismet or core:wordpress), version, severity (critical for urgent findings, warning for the rest), cvss, fixed and title. Add --format=json, csv or yaml for other formats. When the download fails, the command prints Warning: followed by the reason.

When a download fails

SafeHouse keeps the data and findings it has, records the error and tries again after an hour. The error shows in Details as "The last download failed:" with the reason, and in Site Health while no data has been downloaded yet. It is not e-mailed.

Error	Cause
A connection error from WordPress, or HTTP 404 for https://updates.designhouse.me/shouse/advisories/index.json	The server cannot reach the update host, or the host did not answer with the file.
"Vulnerability data signature is invalid."	The index does not match its signature. Also logged as advisories_rejected (critical).
"Vulnerability data has an unknown format."	The index or a shard is not in the expected format.
"Vulnerability data does not match its signed checksum."	A shard differs from the hash in the signed index. Also logged as advisories_rejected (critical).

The server needs outgoing HTTPS to updates.designhouse.me.

Test with your own data

On a site whose environment type is local or development (WP_ENVIRONMENT_TYPE), two constants point the module at other data. Every other environment type, including staging, ignores them. Add them to that site's wp-config.php:

define( 'SHOUSE_ADVISORY_URL', 'http://advisories.test/advisories/index.json' );
define( 'SHOUSE_ADVISORY_PUBLIC_KEYS', [ 'BASE64_PUBLIC_KEY' ] );

SHOUSE_ADVISORY_URL replaces the index address; the shards are read from the same folder. On those sites the host may be on a private network. SHOUSE_ADVISORY_PUBLIC_KEYS replaces the built-in key.

With Wordfence and other plugins

• While Wordfence is active, Vulnerability alerts is Unavailable and does not run, whatever Wordfence's own settings are: no notice, no Site Health test, no WP-CLI command and no e-mails. Wordfence warns about vulnerable software itself. Set SHOUSE_IGNORE_OVERLAPS to true to run both; they then warn about the same software.
• When Wordfence is not installed, the Integrations tab says in the Wordfence row either "SafeHouse vulnerability alerts cover this site. For a firewall and two-factor login, install Wordfence." or, when the module is not running, "Nothing warns about vulnerable plugins on this site: switch on SafeHouse vulnerability alerts below, or install Wordfence."
• Plugin health covers a different risk: plugins closed on WordPress.org or no longer updated.

What it stores

• Option shouse_vulnerabilities (not autoloaded): the time of the last attempt, the last error, the build time and attribution of the data, and the downloaded shards, each with its hash and only the entries for software installed on the site.
• Option shouse_vulnerabilities_findings: the current findings, kept so that the admin notice does not recompute them on every screen.
• Option shouse_vulnerabilities_notified: which findings existed at the previous download attempt, to tell which ones are new.
• Activity log entries: vulnerability_found and advisories_rejected.

Limitations

• E-mails can repeat: a finding that goes away and comes back is e-mailed again.
• A vulnerable version that arrives without a download, such as a rollback over FTP, is e-mailed only at the next download, about 6 hours after the last one.
• SafeHouse does not check how old the signed data is. It accepts any correctly signed data, and Details shows when the site last checked, not when the data was built.
• Only vulnerabilities in the Wordfence Intelligence data are found. Vulnerability alerts does not scan files, has no firewall and does not stop an attack on vulnerable software.
• Software is matched by slug. A custom plugin or theme whose folder name equals the slug of a listed plugin or theme gets that software's findings.
• Inactive plugins and unused themes count. The urgent notice stays until they are updated or deleted.
• The module is unavailable whenever Wordfence is active, even if Wordfence's own vulnerability warnings are off.
• Downloads depend on WP-Cron. Without WP-Cron, data arrives only with Check now or WP-CLI.

Related pages

• Plugin health
• Signed updates
• Data and privacy
• Running with Wordfence
• Command line reference