Add no-key live WordPress vulnerability lookup#365
Conversation
Fresh WordPress plugin advisories should not depend on a paid or preconfigured scanner token. The WordPress fingerprinter now queries WPVulnerability's no-key JSON API by plugin/theme slug, filters entries against the detected installed version, and merges those findings with the local catalog, optional WPScan API data, and OSV. Constraint: Keep the scanner policy-safe; structured advisory lookup is not generic scanner traffic. Constraint: WPScan still requires a token, so it remains optional instead of the default freshness path. Rejected: Web-search every plugin during the scan | higher latency and higher hallucination risk than structured feeds. Rejected: Require WPSCAN_API_TOKEN for fresh data | unnecessary because WPVulnerability exposes a no-key API. Confidence: high Scope-risk: moderate Directive: Prefer structured vulnerability feeds before web-search based enrichment; do not fabricate CVE ids from provider-internal hashes. Tested: pnpm --filter @pwnkit/core test -- src/agent/wp-fingerprint.test.ts src/agent/wp-vuln-db.test.ts src/agent/tools.test.ts Tested: pnpm --filter @pwnkit/core build Tested: live WPVulnerability smoke for contact-form-7@5.3.1 Tested: pnpm lint Tested: pnpm build Tested: pnpm test Tested: git diff --check
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
Verification