When security vulnerabilities are published for a WordPress plugin, the VIP team is notified and often we will help mitigate severe issues behind the scenes in order to prevent exploitation across vulnerable sites. This is not always possible for every vulnerability, and these mitigations are only meant to be a temporary solution. The real solution to this problem is keeping plugins updated and patched.
With that goal in mind, you may have also noticed that we introduced a new security scanning feature a few months ago that contributes to site security by occasionally opening plugin update pull requests in the GitHub repositories when newly released severe vulnerabilities are found. One of the main downsides to this is the lack of visibility as not every plugin vulnerability has an available patch, so no pull request could be created.
Today, we’re happy to announce more visibility and control with this plugin vulnerability scanning. There is now a page in the VIP Dashboard, located at Codebase > Plugins, that lists the plugins installed on the environment along with any known security issues.
Along with displaying any found security vulnerabilities, you will also be able see if there are any updates available for the plugin. And whether there are any vulnerabilities or just an update available, this new feature also has the ability to create plugin update pull requests on demand. Simply click the “Create Pull Request” button, take a sip of your coffee, and then head over to GitHub where you can merge in the changes!
Read more information about Codebase Manager and this new plugins screen.
Responses