內容簡介
VulnCue 是一款專為 WordPress 設計的安全掃描外掛，能夠從內部檢查網站的安全性，包括已安裝的外掛和佈景主題、核心版本、PHP 版本等，提供全面的安全評估，並可選擇接收漏洞警報。
【主要功能】
• 內部掃描已安裝的外掛和佈景主題
• 檢查過時的核心和不支援的 PHP 版本
• 內建雙重身份驗證（2FA）功能
• 提供安全性檢查報告，無需註冊帳號
• 支援敏感檔案檢查及管理員用戶暴露問題
• 可選擇接收新漏洞的電子郵件通知
外掛標籤
開發者團隊
原文外掛簡介
VulnCue scans your WordPress from the inside, something an external
scanner can’t do with the same precision: an exact inventory of installed
plugins and themes, outdated core, an unsupported PHP version, uncustomized
wp-config.php security keys, an active file editor, an exposed “admin” user,
active XML-RPC, sensitive files left in the public folder (backups, .env,
.git), and more.
VulnCue also checks your exact PHP version against PHP2Shell
(CVE-2026-109618 / CVE-2026-109619), the two critical, unauthenticated
remote-code-execution vulnerabilities patched in October 2026 — accurately,
because the check reads PHP_VERSION directly inside your own WordPress
instead of guessing from a header your hosting might hide (which is the
best a purely external scanner, including our own free online checker at
vulncue.com/herramientas/comprobador-php2shell, can ever do).
All of these checks are 100% free, with no need to create an account or
give your email. If you want an email alert when a new vulnerability (CVE)
affects one of your installed plugins, you can connect a free account from
VulnCue’s client area (https://vulncue.com/) — optional, never required to
use the plugin.
VulnCue also includes its own free, built-in two-factor authentication
(2FA) — no extra plugin needed. Any user activates it in under 2 minutes
from their own profile by scanning a QR code with an authenticator app
(Google Authenticator, Authy, Microsoft Authenticator…); administrators can
also require it for specific roles, with a configurable grace period so
nobody is locked out by surprise, plus one-time backup codes and an
emergency wp-config.php kill switch. It never affects Application
Passwords, the REST API or XML-RPC. See the Frequently Asked Questions
section below for details.
External services
By default, this plugin sends no data to external servers. All checks
use WordPress’s own data (update transients, wp-config.php constants, the
public folder’s file listing). The two-factor authentication feature is
100% local as well: the secret, the backup codes and the code check never
leave your WordPress, and the QR code is drawn in your own browser with no
network call at all.
Six exceptions, all of which can be turned off or only trigger on your
explicit action (the first three from the plugin’s screen; the fourth and
fifth only activate if you connect an account yourself; the sixth only if
you choose to send it):
Checks that make the site send a request to itself: XML-RPC
(xmlrpc.php), user enumeration via the REST API (/wp-json/wp/v2/users),
SSL/TLS certificate expiry and trust (two HTTPS connections to the site’s
own domain), directory listing on wp-content/uploads/, and whether the
homepage reveals the WordPress version in the
tag. None of these requests go out to VulnCue or any third party — it’s
your own WordPress talking to itself to check how it responds. The whole
group can be disabled with the “Include checks that make this site send a
request to itself” checkbox.
Known vulnerability check (enabled by default, no account or email
needed): the plugin sends vulncue.com the list of installed plugins and
themes (only the technical name and version, never personal data or
anything about your site) to check them against VulnCue’s public CVE
catalog. Can be disabled with the “Check installed plugins/themes against
VulnCue’s public vulnerability catalog” checkbox.
Core integrity verification (enabled by default, no account or email
needed): the plugin queries api.wordpress.org (WordPress’s own official
server, not VulnCue’s) to get the public checksums for your WordPress
version and check that the core files haven’t been modified. Only the
WordPress version and language are sent, never anything about your site.
Can be disabled with the “Check WordPress core integrity” checkbox.
Account connection (optional, the only one that sends your email): if
you choose to enter your email to connect a free account, the plugin sends
your site’s URL, your email, and your WordPress version to vulncue.com, to
create your account and be able to email you about new CVEs. Privacy
policy: https://vulncue.com/politica-privacidad.html
Scheduled auto-scan + inventory report (only if you connected an
account): every hour, WP-Cron checks (sending only your connection key)
whether a new automatic scan is due — every 7 days on the free plan, every
day on a paid plan; the hourly check only shortens the wait for the first
scan after connecting, it doesn’t increase the actual frequency. When it’s
due, besides scanning your site it sends the
list of installed plugins and themes (technical name and version, never
personal data) so it can email you if any of them has a new vulnerability
— each alert is sent only once per vulnerability. Also, once your account
is connected, you’ll get a weekly email with your current risk level and
findings (this summary is sent by your own WordPress, not by vulncue.com).
If you haven’t connected an account, none of this happens and scanning
stays fully manual (“Scan again”).
Deactivation survey (optional): when you deactivate the plugin you can
say why. Choosing “Skip” sends nothing. Writing something and confirming
sends vulncue.com the site’s URL, the reason, and the WordPress/PHP/plugin
versions — never your email or any other personal data.
