About this plugin
VulnDex Beacon connects your WordPress site to an existing VulnDex account. It reports the installed WordPress core, plugin, and theme versions so VulnDex can identify relevant known vulnerabilities and keep the site’s component inventory current.
VulnDex is a team-oriented vulnerability management platform. It brings vulnerability and inventory data into a shared view where affected components can be assigned to responsible teams and remediation progress can be coordinated.
The Beacon is an inventory connector. It does not scan files, database content, or traffic; patch vulnerable components; block attacks; or replace a vulnerability scanner, firewall, or other security controls.
Features
- Reports the WordPress core version and installed plugins and themes, including their versions and activation status.
- Schedules synchronization every two hours through WP-Cron.
- Schedules additional reports after plugin or theme changes and WordPress update operations.
- Provides a manual send action and the latest connection status under Settings > VulnDex Beacon.
- Uses a unique Node ID to identify the WordPress site in VulnDex.
- Sends authenticated requests to a fixed VulnDex API endpoint over HTTPS.
- Enables reported versions to be viewed with relevant vulnerability information, team assignments, and version history in VulnDex.
Requirements
- WordPress 5.8 or later.
- PHP 7.4 or later.
- A VulnDex account with a Beacon integration and API key.
- Outbound HTTPS access to api.vulndex.at.
- A working WP-Cron setup for scheduled reports.
External Service and Privacy
This plugin connects to VulnDex, an external vulnerability management service. The service is required to receive the reported inventory, correlate versions with known vulnerability information, and display the results in VulnDex. A VulnDex account and API key are required to use these features.
No request is sent to VulnDex until a non-empty API key has been saved. Once configured, the plugin sends reports:
- On the recurring two-hour WP-Cron schedule. Actual timing depends on WordPress cron execution and site traffic.
- Shortly after an API key is added or changed.
- After plugin activation or deactivation, a theme switch, or a WordPress update operation.
- When an administrator manually starts a report.
at/beacon/wordpress. The API key is included as a Bearer credential in the Authorization header.
The report payload contains:
- A randomly generated Node ID that identifies the site in VulnDex.
- WordPress and PHP versions.
- Site URL and home URL.
- Installed plugin path, slug/text domain, name, version, and activation status.
- Installed theme stylesheet identifier, name, version, and activation status.
- Operating-system and host/kernel information returned by PHP’s php_uname() function, when available.
The report payload does not include WordPress user accounts, posts, pages, comments, media, passwords, database content, or file contents. As with any HTTPS request, the receiving server may also process connection metadata such as the server’s public IP address and request time.
Learn more about the VulnDex Beacon service, the VulnDex Privacy Policy, and the provider details.
License
VulnDex Beacon is free software licensed under GPLv2 or later. You may redistribute or modify it under the terms of the GNU General Public License as published by the Free Software Foundation.