Website

WordPress Plugin & Theme Vulnerabilities

On WordPress sites the vast majority of vulnerabilities live in plugins, not in core. Specula builds a plugin and theme inventory from your site's HTML and matches it against the Wordfence Intelligence catalogue. The hard part isn't finding the plugin — it's reading its version correctly.

• Version reading, solved by measurement

  The ?ver= in a plugin URL lies in four different ways: no version at all, a timestamp, the WordPress core version, or the version of a library bundled inside the plugin. The last one produced a false “Critical” on a real customer.

• Majority rule, plus three rejections

  The plugin's own files are read and the majority wins; values without a dot are rejected, values matching the core version are rejected, and a tie counts as uncertainty. The plugin's own readme file is consulted as a second source.

• Confidence is printed on screen

  Where the version came from is stated: readme (the plugin's own file), from assets (majority), or weak (a single file). A weak reading never enters a notification.