內容簡介
VulnDex Beacon 將您的 WordPress 網站連接至現有的 VulnDex 帳戶，報告已安裝的 WordPress 核心、外掛和佈景主題版本，以便 VulnDex 識別相關已知漏洞並保持網站組件清單的最新狀態。
【主要功能】
• 報告 WordPress 核心、外掛及佈景主題版本
• 每兩小時自動同步資料
• 支援手動發送報告
• 提供最新連接狀態顯示
• 使用獨特的 Node ID 識別網站
外掛標籤
開發者團隊
原文外掛簡介
VulnDex Beacon connects your WordPress site to an existing VulnDex account. It reports the installed WordPress core, plugin, and theme versions so VulnDex can identify relevant known vulnerabilities and keep the site’s component inventory current.
VulnDex is a team-oriented vulnerability management platform. It brings vulnerability and inventory data into a shared view where affected components can be assigned to responsible teams and remediation progress can be coordinated.
The Beacon is an inventory connector. It does not scan files, database content, or traffic; patch vulnerable components; block attacks; or replace a vulnerability scanner, firewall, or other security controls.
Features
Reports the WordPress core version and installed plugins and themes, including their versions and activation status.
Schedules synchronization every two hours through WP-Cron.
Schedules additional reports after plugin or theme changes and WordPress update operations.
Provides a manual send action and the latest connection status under Settings > VulnDex Beacon.
Uses a unique Node ID to identify the WordPress site in VulnDex.
Sends authenticated requests to a fixed VulnDex API endpoint over HTTPS.
Enables reported versions to be viewed with relevant vulnerability information, team assignments, and version history in VulnDex.
Requirements
WordPress 5.8 or later.
PHP 7.4 or later.
A VulnDex account with a Beacon integration and API key.
Outbound HTTPS access to api.vulndex.at.
A working WP-Cron setup for scheduled reports.
External Service and Privacy
This plugin connects to VulnDex, an external vulnerability management service. The service is required to receive the reported inventory, correlate versions with known vulnerability information, and display the results in VulnDex. A VulnDex account and API key are required to use these features.
No request is sent to VulnDex until a non-empty API key has been saved. Once configured, the plugin sends reports:
On the recurring two-hour WP-Cron schedule. Actual timing depends on WordPress cron execution and site traffic.
Shortly after an API key is added or changed.
After plugin activation or deactivation, a theme switch, or a WordPress update operation.
When an administrator manually starts a report.
Reports are sent by HTTPS POST to https://api.vulndex.at/beacon/wordpress. The API key is included as a Bearer credential in the Authorization header.
The report payload contains:
A randomly generated Node ID that identifies the site in VulnDex.
WordPress and PHP versions.
Site URL and home URL.
Installed plugin path, slug/text domain, name, version, and activation status.
Installed theme stylesheet identifier, name, version, and activation status.
Operating-system and host/kernel information returned by PHP’s php_uname() function, when available.
The report payload does not include WordPress user accounts, posts, pages, comments, media, passwords, database content, or file contents. As with any HTTPS request, the receiving server may also process connection metadata such as the server’s public IP address and request time.
Learn more about the VulnDex Beacon service, the VulnDex Privacy Policy, and the provider details.
License
VulnDex Beacon is free software licensed under GPLv2 or later. You may redistribute or modify it under the terms of the GNU General Public License as published by the Free Software Foundation.
