A few months back, WordPress VIP added plugin vulnerability information and a mechanism to update plugins to the VIP Dashboard with the aim of helping customers to keep their sites secure and up to date.
We are pleased to announce that today we are extending this functionality to earlier in the development lifecycle by enabling customers to detect plugins and themes with known security vulnerabilities before code is deployed to their codebase.
This extended functionality is provided by the VIP Code Analysis Bot. This enhancement enables detection of known security vulnerabilities for plugins and themes added to or updated in pull requests. Detection is performed using WPScan, a database of known security vulnerabilities affecting WordPress plugins and themes. The new functionality also detects out of date plugins and themes. The Bot will provide feedback to the relevant pull request in case of detection.
Feedback from the Bot noting an issue with a plugin. Feedback for themes is displayed separately from plugins, but is formatted in the same way.
This new addition helps VIP customers ensure they deploy only secure and up to date plugins and themes. WordPress VIP constantly strives to make it easy for customers to maintain security of their sites.
We recommend updating a plugin or theme to the latest version when the Bot notes a plugin/theme version with a known vulnerability or where the version is out of date. Use the VIP Dashboard Plugins panel to issue pull requests with updates, in case of a plugin or theme already deployed to a main branch.
Read more about the new addition to the VIP Code Analysis Bot in our documentation.