Changelog

All notable changes to RatSweepr are documented here. The format is based on Keep a Changelog and RatSweepr follows Semantic Versioning.

[2.9.19] - 2026-10-19

Replaced the old WPScan integration with an optional, free Wordfence Intelligence vulnerability-feed check: bring your own free Wordfence key and the scan will flag outdated-and-vulnerable WordPress core, plugins and themes, with a link to the advisory and the patched version. No key needed for two other new checks: a hand-picked list of actively-exploited plugin CVEs, and a free wordpress.org-based outdated-plugin check for everything else. Also added detection for the October 2026 Rank Math SEO PRO supply-chain compromise (a second backdoored plugin’s fake maintenance tool, a fake core file, a .htaccess/.cache execution trick, and published indicators), a second known variant of the UpdraftCentral key-compromise backdoor, and a correction to the UpdraftPlus entry (an older, separate code vulnerability now shows as actively exploited per a fresh advisory, clearly distinguished from the unrelated, no-CVE key-compromise incident that affects every version). A pre-existing gap was also fixed: a backdoor-type signature match inside a trusted/allowlisted path is now always reported at full severity instead of being quietly downgraded.

Added

• Optional check against the Wordfence Intelligence vulnerability feed. Requires a free API key from wordfence.com (your own account, never required). Checks installed WordPress core, plugins and themes; results show the issue, the installed and patched versions, and a link to the advisory. Required attribution text is included automatically whenever a result is shown. The feed is downloaded at most once a day and reused from cache if Wordfence is unreachable.
• Free check (no key needed) comparing every wordpress.org-hosted plugin’s installed version against the latest version on wordpress.org. Reports plainly as ‘outdated’, never ‘vulnerable’, unless a vulnerability was already confirmed by the hand-picked list or the Wordfence feed. Plugins not sold on wordpress.org are reported as ‘can’t check automatically, verify with the vendor’ instead of guessing.
• Detection for the October 2026 Rank Math SEO PRO supply-chain compromise: a hand-picked entry flags the exact compromised version by its own name, a new signature matches its published malicious code markers, a dedicated check looks for its fake core file and its .htaccess/.cache execution trick, and read-only extras surface its published database and cron indicators without changing anything.
• Added a signature for a second known variant of the October 2026 UpdraftCentral key-compromise backdoor (one that also hides its planted account from admin-list lookups), plus read-only checks for its published account/plugin-name indicators. Separately corrected the hand-picked UpdraftPlus entry: a different, older code vulnerability is now marked actively exploited per a fresh advisory, and its wording now clearly distinguishes it from the unrelated key-compromise incident, which has no CVE and affects every version.

Fixed

• A signature match for a backdoor-type rule can no longer be silently downgraded to informational just because it’s inside a trusted/allowlisted path. Backdoor-class findings are now always reported at full severity.

Removed

• Removed the WPScan API integration and all related configuration and documentation. WPScan’s free tier isn’t licensed for commercial use, so it’s been fully replaced by the two checks above.

[2.9.18] - 2026-10-19

New detection rules for three live campaigns reported in October 2026: a fake ‘maintenance toolkit’ plugin tied to a stolen UpdraftCentral signing key, a hidden-admin-account backdoor delivered through a chain of plugin vulnerabilities, and malicious PHP files dropped into specific plugin upload folders. Also added a short, hand-picked list of plugin versions with known, often actively-exploited vulnerabilities, reported clearly as ‘outdated/vulnerable’ rather than ‘infected’.

Added

• New signature for the October 2026 UpdraftCentral key-compromise campaign: a fake maintenance-toolkit plugin that creates a hidden admin session. Sites running UpdraftPlus also get a one-time advisory note about checking for and removing a specific leftover option, and reviewing access logs for a specific file signature.
• New signatures for the specific file paths and a revealing code comment used by an October 2026 hidden-admin-account campaign chained through several plugin vulnerabilities. These do not rely on file modification times, which this particular attacker deliberately backdates.
• Specific, high-confidence upload-folder paths tied to recent exploits (plus a specific suspicious filename pattern anywhere under uploads) now report at a higher severity than a generic ‘PHP file found in uploads’ finding.
• New, pure-bash check comparing an installed plugin’s version (read from its own plugin header) against a short, hand-picked list of public CVEs. Reported as ‘outdated/vulnerable’, with the CVE and a link to the advisory - never worded as ‘infected’. Entries marked as actively exploited report at a higher severity.

[2.9.17] - 2026-10-18

quarantine_from_report (and clean_core, defensively) now refuse to ever move, rename or overwrite wp-config.php - matched by basename AND resolved real path, so a same-named decoy elsewhere in the tree is unaffected and wp-config-sample.php stays quarantinable. scan_wpconfig_content now records the exact flagged line number(s) in the report DETAIL. New read-only wp-config-review subcommand shows flagged lines with 2 lines of context, secrets masked. No detection logic, category, or severity changed; ratsweepr.yar unchanged (still 29 rules, unaffected by this pass).

Changed

• New helper used by quarantine_from_report (primary) and clean_core (defense-in-depth; structurally unreachable there since wp-config.php is never in the official core-checksum manifest). Matches by basename AND resolved real path against $WPROOT/wp-config.php or $WPROOT/../wp-config.php
• Wp-config-rogue-include and wp-config-injected-code DETAIL now starts with ‘L: ’ (exact grep -n line number) or ‘line unknown, review the whole file’ as a fallback; detection regexes, categories, and severities unchanged
• New helper redacts DB_PASSWORD and any _KEY/_SALT define() value to MASKED before any flagged-line text is printed (scan report DETAIL, the quarantine [ACTION] block, and wp-config-review)
• New read-only CLI subcommand: prints every flagged wp-config.php line with 2 lines of context, secrets masked, each displayed line truncated to ~160 chars

[2.9.15] - 2026-10-16

Added

• Goto-obfuscated malware detection. Catches PHP that hides an eval/base64 payload behind scrambled goto jumps, a trick seen injected into a premium plugin’s view file. Normal goto loops are not flagged.
• Self-bootstrapping backdoor detection. Catches standalone files that climb directories looking for wp-load.php and then run commands sent in a request. Legitimate plugin bootstraps are not flagged.
• Reassembled superglobal detection. Catches code that rebuilds names like _COOKIE (or function names) from string fragments to feed eval(base64_decode(...)), a common scanner-evasion trick.
• External script injection detection. Catches plaintext <script src> tags pointing at typosquatted CDNs (for example coredelivr / quickdelivr), known payload paths, or spam-TLD hosts inside theme and plugin files. Real CDNs such as jsDelivr and Google Tag Manager are excluded.
• Fake plugin detection. Flags plugin folders named like word-<random hex> and plugins that ship a bare payload.php. Works even on hosts where PHP is restricted; files are still content-scanned.

Every new rule was validated against real malware samples collected during cleanups and checked for false positives against legitimate code.

[2.9.14] - 2026-10-16

Fixed

Fewer false positives burying real findings. Strong signals (real code statements, PHP shells, backdoor and injection rules) stay fully active; only weak signals were narrowed.

• wp-config.php rogue-include check no longer fires on the stock WordPress comment, only on real require/include statements.
• The CVE-2026-87902 marker check now scans only .php/.phtml files and skips .sql dumps and backup-plugin folders.
• Normal eval/pack usage inside well-known vendor libraries (PDF, UTF-8 and CSS libraries) is downgraded to INFO. Backdoor and injection rules are never downgraded, so a shell hidden in a vendor folder still reports HIGH.
• Legitimate host and management mu-plugins are allowlisted, but only when their content is clean. Attackers imitating those file names are still flagged.
• Leftover license keys from premium plugins/themes are flagged HIGH only when the plugin or theme is actually missing (a true orphan); otherwise you get an INFO “verify your license” note.

[2.9.13] - 2026-10-16

Added

• Scanning of mu-plugins for unexpected PHP files (a favorite auto-loading backdoor spot), with an escape hatch for trusted vendors.
• Content inspection of wp-config.php, which checksum verification can’t cover.
• Detection of hardcoded URL-key admin-login bypasses.
• Detection of fake cache plugins acting as a proxy to a remote command server.

Changed

• Self-hiding plugin detection broadened to catch plugins that remove themselves from the plugin list.

[2.9.12] - 2026-10-16

Added

• Detection for CVE-2026-87902, an actively exploited unauthenticated path-traversal to remote code execution issue affecting WordPress 4.7.0–7.1.1 (fixed in 7.1.2). Affected versions are reported HIGH with a temporary WAF mitigation.
• A database-independent hunt for known exploit payload files, so sites that were already exploited are caught even after updating.

[2.9.11] - 2026-10-16

Removed

• The Go/TUI version. RatSweepr is now a single bash script with one codebase and one version number. Releases ship the script only, with no compiled binaries, and CI now lints the bash code.