Automated vulnerability scanning in CI/CD for WordPress: Wordfence CLI vs manual audits

# .github/workflows/security-gate.yml
name: security-gate

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: "23 5 * * *"        # daily: new disclosures land on code that hasn't changed
  workflow_call:                # lets deploy.yml run it first: needs: security-gate

permissions:
  contents: read

jobs:
  security-gate:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v5
      - id: day
        run: echo "date=$(date -u +%F)" >> "$GITHUB_OUTPUT"
      - name: Restore the vulnerability feed (one download a day, yesterday's copy if the API says 429)
        uses: actions/cache@v4
        with:
          path: .cache/wfi-production.json
          key: wfi-feed-${{ steps.day.outputs.date }}
          restore-keys: wfi-feed-
      - name: Known vulnerabilities, modified wordpress.org plugins, obfuscated code
        env:
          WFI_API_KEY: ${{ secrets.WFI_API_KEY }}
        run: >
          python3 .github/security/wp_vuln_gate.py
          --fail-on 7.0
          --scan-dir wp-content/plugins/store-core
          --scan-dir wp-content/themes/store-child

jobs:
  security:
    uses: ./.github/workflows/security-gate.yml
    secrets: inherit

  test:
    needs: security
    # ... the rest of the deploy pipeline is unchanged

#!/usr/bin/env python3
"""Fail a CI build when the WordPress plugins, themes or core in this repository have known vulnerabilities, when a
wordpress.org plugin was modified, or when code looks obfuscated.

  python3 wp_vuln_gate.py [--root .] [--fail-on 7.0] [--ignore .wpvuln-ignore] [--cli-csv results.csv]

Vulnerability data: the Wordfence Intelligence v3 production feed (free API key in WFI_API_KEY), cached in
FEED_CACHE for 24 hours. With --cli-csv, findings come from `wordfence vuln-scan --output-format csv` instead.
Exit 1 when anything fails the gate. Python 3.9+, standard library only."""
import argparse, csv, datetime, hashlib, json, os, re, sys, time, urllib.error, urllib.request
from pathlib import Path

FEED_URL = os.environ.get('WFI_FEED_URL', 'https://www.wordfence.com/api/intelligence/v3/vulnerabilities/production')
FEED_CACHE = Path(os.environ.get('FEED_CACHE', '.cache/wfi-production.json'))
CHECKSUMS = os.environ.get('WPORG_CHECKSUMS', 'https://downloads.wordpress.org/plugin-checksums/{slug}/{version}.json')
HEADER = re.compile(r'^[ \t/*#@]*{}:(.*)$', re.M | re.I)
FORMS = {'dev': 0, 'alpha': 1, 'a': 1, 'beta': 2, 'b': 2, 'rc': 3, '#': 4, 'pl': 6, 'p': 6}


# ------------------------------------------------------------------ versions: PHP's version_compare(), as WordPress uses
def _parts(v):
    v = re.sub(r'[-_+]', '.', v.strip())
    v = re.sub(r'(?<=\d)(?=[^\d.])|(?<=[^\d.])(?=\d)', '.', v)
    return [(5, int(p)) if p.isdigit() else (FORMS.get(p.lower(), -1), 0) for p in v.split('.') if p]


def vcmp(a, b):
    pa, pb = _parts(a), _parts(b)
    for i in range(max(len(pa), len(pb))):
        x = pa[i] if i < len(pa) else (4, 0)   # a missing part ranks like PHP's "#": below numbers, above RC
        y = pb[i] if i < len(pb) else (4, 0)
        if x != y:
            return -1 if x < y else 1
    return 0


def in_range(version, r):
    lo = r['from_version'] == '*' or vcmp(version, r['from_version']) >= (0 if r['from_inclusive'] else 1)
    hi = r['to_version'] == '*' or vcmp(version, r['to_version']) <= (0 if r['to_inclusive'] else -1)
    return lo and hi


# ------------------------------------------------------------------ inventory
def header(path, field):
    m = re.compile(HEADER.pattern.format(field), HEADER.flags).search(path.read_bytes()[:8192].decode('utf-8', 'replace'))
    return m and m.group(1).strip().rstrip('*/').strip()   # WordPress also reads only the first 8 KB


def inventory(root):
    found = []   # (type, slug, version, path)
    m = (root / 'wp-includes/version.php').exists() and re.search(r"\$wp_version\s*=\s*'([^']+)'", (root / 'wp-includes/version.php').read_text())
    if m:
        found.append(('core', 'wordpress', m.group(1), root / 'wp-includes'))
    for content in (root / 'wp-content', root / 'web/app'):   # standard layout and Bedrock
        for p in sorted((content / 'plugins').glob('*')):
            mains = [p] if p.suffix == '.php' else sorted(p.glob('*.php')) if p.is_dir() else []
            main = next((f for f in mains if header(f, 'Plugin Name')), None)
            if main:
                found.append(('plugin', p.stem if p.is_file() else p.name, header(main, 'Version') or '0', p))
        for p in sorted((content / 'themes').glob('*/style.css')):
            if header(p, 'Theme Name'):
                found.append(('theme', p.parent.name, header(p, 'Version') or '0', p.parent))
    lock = root / 'composer.lock'
    if lock.exists():
        for pkg in json.loads(lock.read_text()).get('packages', []):
            kind, _, slug = pkg['name'].partition('/')
            if kind in ('wpackagist-plugin', 'wpackagist-theme') and not any(f[1] == slug for f in found):
                found.append((kind.split('-')[1], slug, pkg['version'].lstrip('v'), lock))
    return found


# ------------------------------------------------------------------ known vulnerabilities
def load_feed():
    fresh = FEED_CACHE.exists() and time.time() - FEED_CACHE.stat().st_mtime < 86400
    if not fresh and os.environ.get('WFI_API_KEY'):
        req = urllib.request.Request(FEED_URL, headers={'Authorization': 'Bearer ' + os.environ['WFI_API_KEY']})
        try:
            with urllib.request.urlopen(req, timeout=120) as r:
                data = r.read()
            json.loads(data)
            FEED_CACHE.parent.mkdir(parents=True, exist_ok=True)
            FEED_CACHE.write_bytes(data)
        except (urllib.error.URLError, ValueError) as e:
            if not FEED_CACHE.exists():
                sys.exit(f'::error::cannot download the vulnerability feed and there is no cached copy: {e}')
            print(f'::warning::feed download failed ({e}), using the cached copy from '
                  f'{datetime.datetime.fromtimestamp(FEED_CACHE.stat().st_mtime):%Y-%m-%d %H:%M}')
    if not FEED_CACHE.exists():
        sys.exit('::error::set WFI_API_KEY (free key from your wordfence.com account) or provide FEED_CACHE')
    return json.loads(FEED_CACHE.read_text(encoding='utf-8'))


def match_feed(feed, items):
    index = {}
    for v in feed.values():
        for sw in v['software']:
            index.setdefault((sw['type'], sw['slug']), []).append((v, sw))
    findings = []
    for kind, slug, version, path in items:
        for v, sw in index.get((kind, slug), []):
            if not v.get('informational') and any(in_range(version, r) for r in sw['affected_versions'].values()):
                cvss = v.get('cvss') or {}
                findings.append({'id': v['id'], 'cve': v.get('cve') or '', 'slug': slug, 'version': version, 'path': str(path),
                                 'title': v['title'], 'score': cvss.get('score'), 'rating': cvss.get('rating') or 'unrated',
                                 'fix': ', '.join(sw['patched_versions']) if sw['patched'] else 'no fix: remove or replace',
                                 'link': f'https://www.wordfence.com/threat-intel/vulnerabilities/id/{v["id"]}'})
    return findings


def from_cli_csv(path):
    """`wordfence vuln-scan --output-format csv --output-headers --output-columns software_type,slug,version,id,cve,title,patched,scanned_path`
    Add cvss_score,cvss_rating only if every match has a CVSS score: CLI 5.0.6 crashes on a record without one.
    Rows without a score count as unrated and block."""
    with open(path, newline='', encoding='utf-8') as f:
        return [{'id': r['id'], 'cve': r.get('cve', ''), 'slug': r['slug'], 'version': r['version'], 'path': r.get('scanned_path', ''),
                 'title': r['title'], 'score': float(r['cvss_score']) if r.get('cvss_score') else None,
                 'rating': r.get('cvss_rating') or 'unrated', 'fix': 'see link' if r.get('patched') == 'True' else 'no fix: remove or replace',
                 'link': f'https://www.wordfence.com/threat-intel/vulnerabilities/id/{r["id"]}'} for r in csv.DictReader(f)]


# ------------------------------------------------------------------ modified wordpress.org plugins
def integrity(items):
    """Compare each wordpress.org plugin with the checksums of that exact release. 404 = not from wordpress.org."""
    problems = []
    for kind, slug, version, path in items:
        if kind != 'plugin' or not path.is_dir():
            continue
        try:
            with urllib.request.urlopen(CHECKSUMS.format(slug=slug, version=version), timeout=60) as r:
                files = json.loads(r.read())['files']
        except urllib.error.HTTPError as e:
            if e.code != 404:
                problems.append((path, f'{slug} {version}: checksums unavailable (HTTP {e.code}), not verified'))
            continue
        except urllib.error.URLError as e:
            problems.append((path, f'{slug} {version}: checksums unavailable ({e.reason}), not verified'))
            continue
        for f in path.rglob('*'):
            rel = f.relative_to(path).as_posix()
            if not f.is_file() or rel.startswith('.git'):
                continue
            want = files.get(rel, {}).get('sha256')
            if want is None:
                if f.suffix.lower() in ('.php', '.phtml', '.js'):
                    problems.append((f, f'{slug} {version}: {rel} is not part of the wordpress.org release'))
            elif hashlib.sha256(f.read_bytes()).hexdigest() not in ([want] if isinstance(want, str) else want):
                problems.append((f, f'{slug} {version}: {rel} differs from the wordpress.org release'))
    return problems


# ------------------------------------------------------------------ obfuscated code
DECODERS = r'(?:base64_decode|gzinflate|gzuncompress|gzdecode|str_rot13|strrev|hex2bin|convert_uudecode)'
RULES = [
    ('error', 'decoded data executed', re.compile(r'\b(?:eval|assert|create_function)\s*\(\s*(?:@\s*)?' + DECODERS + r'\s*\(', re.I)),
    ('error', 'decoder chain', re.compile(DECODERS + r'\s*\(\s*' + DECODERS + r'\s*\(', re.I)),
    ('warning', 'long encoded string', re.compile(r'[\'"][A-Za-z0-9+/=\\x]{1000,}[\'"]')),
]


def obfuscation(text):
    return [(level, what, text.count('\n', 0, m.start()) + 1) for level, what, rx in RULES for m in rx.finditer(text)]


# ------------------------------------------------------------------ gate
def ignores(path):
    """Lines: <vulnerability UUID or CVE> until=YYYY-MM-DD  # reason. Expired lines stop counting."""
    active = {}
    if path and Path(path).exists():
        for line in Path(path).read_text().splitlines():
            m = re.match(r'\s*(\S+)\s+until=(\d{4}-\d\d-\d\d)', line)
            if m and datetime.date.fromisoformat(m.group(2)) >= datetime.date.today():
                active[m.group(1).lower()] = m.group(2)
            elif m:
                print(f'::warning::ignore entry expired on {m.group(2)}: {m.group(1)}')
    return active


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('--root', default='.')
    ap.add_argument('--fail-on', type=float, default=7.0, help='fail on CVSS >= this (unrated findings always fail)')
    ap.add_argument('--ignore', default='.wpvuln-ignore')
    ap.add_argument('--cli-csv')
    ap.add_argument('--scan-dir', action='append', default=[], help='your own code to check for obfuscation')
    a = ap.parse_args()
    root = Path(a.root)
    items = inventory(root)
    findings = from_cli_csv(a.cli_csv) if a.cli_csv else match_feed(load_feed(), items)
    skip = ignores(a.ignore)
    failed, rows = 0, []
    for f in sorted(findings, key=lambda f: -(f['score'] if f['score'] is not None else 11)):
        ignored = f['id'].lower() in skip or f['cve'].lower() in skip
        blocking = not ignored and (f['score'] is None or f['score'] >= a.fail_on)
        failed += blocking
        level = 'error' if blocking else 'warning' if not ignored else 'notice'
        print(f'::{level} title={f["slug"]} {f["version"]}::{f["title"]} [{f["rating"]} {f["score"] or "-"}] fix: {f["fix"]} {f["link"]}')
        rows.append(f'| {"FAIL" if blocking else "ignored" if ignored else "warn"} | {f["slug"]} {f["version"]} | {f["title"]} | '
                    f'{f["rating"]} {f["score"] or ""} | {f["fix"]} | [details]({f["link"]}) |')
    for path, msg in integrity(items):
        failed += 1
        print(f'::error file={path.relative_to(root).as_posix() if path.is_relative_to(root) else path}::{msg}')
        rows.append(f'| FAIL | {path.name} | {msg} | | compare with the official zip | |')
    for d in a.scan_dir:
        for f in Path(d).rglob('*.php'):
            for level, what, line in obfuscation(f.read_text(encoding='utf-8', errors='replace')):
                failed += level == 'error'
                print(f'::{level} file={f.as_posix()},line={line}::{what}')
                rows.append(f'| {"FAIL" if level == "error" else "warn"} | {f.name}:{line} | {what} | | review by hand | |')
    summary = (f'### WordPress security gate\n{len(items)} components, {len(findings)} known vulnerabilities, {failed} blocking\n\n'
               + ('| Result | Component | Issue | Severity | Fix | |\n|---|---|---|---|---|---|\n' + '\n'.join(rows) if rows else 'Nothing found.') + '\n')
    if os.environ.get('GITHUB_STEP_SUMMARY'):
        with open(os.environ['GITHUB_STEP_SUMMARY'], 'a', encoding='utf-8') as s:
            s.write(summary)
    print(f'{len(items)} components checked, {len(findings)} known vulnerabilities, {failed} blocking')
    return 1 if failed else 0


if __name__ == '__main__':
    sys.exit(main())

CVE-2026-90001 until=2026-11-05  # fixed on staging, ships with next week's release
11111111-0000-4000-8000-000000000004 until=2026-10-25  # theme being replaced, upload form disabled

pip install wordfence
wordfence vuln-scan --license "$WORDFENCE_CLI_LICENSE" --accept-terms --no-check-for-update \
  --output-format csv --output-headers --output-path wf.csv \
  --output-columns software_type,slug,version,id,cve,title,patched,scanned_path \
  --plugin-directory wp-content/plugins --theme-directory wp-content/themes
python3 .github/security/wp_vuln_gate.py --cli-csv wf.csv