Vulnerability Patcher

Automatically detect known vulnerabilities in your WordPress plugins, themes, and core, apply virtual patches through WAF rules, manage auto-updates by severity, and roll back problematic changes.

Overview

The VistoShield Vulnerability Patcher continuously monitors your WordPress installation for known security vulnerabilities. When a vulnerability is detected, the plugin can apply a virtual patch immediately (blocking the attack vector without modifying plugin files), schedule an automatic update, or notify you for manual action.

Key capabilities include:

• Synchronized vulnerability database from multiple sources (WPScan, NVD, Patchstack)
• Scheduled and on-demand vulnerability scanning
• Virtual patching via WAF rules that block exploit attempts without changing code
• Severity-based auto-update policies with scheduling controls
• Automatic pre-update backups with one-click rollback
• Configurable notifications with severity thresholds

Installation & Activation

1. Upload the vistoshield-vuln-patcher folder to wp-content/plugins/
2. Navigate to Plugins → Installed Plugins in your WordPress admin
3. Click Activate next to VistoShield Vulnerability Patcher
4. Go to VistoShield → Vuln Patcher to run your first scan

Vulnerability Database

The plugin maintains a local vulnerability database synchronized from multiple sources:

You can trigger a manual sync from VistoShield → Vuln Patcher → Database. The database status indicator shows the last sync time and total number of tracked vulnerabilities.

Scanning

Vulnerability scans compare your installed plugins, themes, and WordPress core version against the local vulnerability database.

To run a manual scan, navigate to VistoShield → Vuln Patcher → Scanner and click Scan Now. Results are displayed immediately and stored in the scan history.

Virtual Patching

Virtual patches protect your site from known exploits without modifying any plugin or theme files. They work by adding targeted WAF rules that block the specific attack vectors associated with a vulnerability.

How virtual patching works:

1. A vulnerability is identified in one of your installed components
2. A matching virtual patch rule is fetched from the vulnerability database
3. The rule is applied to the VistoShield WAF, blocking requests that match the exploit pattern
4. When the component is updated to a patched version, the virtual patch is automatically removed

Auto-Updates

Configure automatic updates based on vulnerability severity from VistoShield → Vuln Patcher → Auto-Updates:

Maintenance windows are configurable by day and time. For example, you can set updates to run only on Tuesdays and Thursdays between 02:00 and 04:00 server time.

Rollback

Before every auto-update, the plugin creates a backup of the affected component. If an update causes issues, you can roll back:

1. Navigate to VistoShield → Vuln Patcher → Update History
2. Find the problematic update in the list
3. Click Rollback to restore the previous version
4. The virtual patch for the vulnerability is automatically re-applied after rollback

Notifications

Configure alert thresholds and delivery channels from VistoShield → Vuln Patcher → Notifications:

• Email — Send alerts to one or more email addresses. Supports HTML and plain text formats.
• Admin Notice — Display a WordPress admin dashboard notice for vulnerabilities at or above the configured severity.
• Digest Mode — Instead of individual alerts, send a daily or weekly summary of all detected vulnerabilities.

You can set a minimum severity threshold for each notification channel independently. For example, send emails only for Critical and High severity issues while showing Admin Notices for Medium and above.

FAQ

Does the plugin modify my plugin or theme files?

Virtual patches do not modify any files. Auto-updates use the standard WordPress update mechanism, which replaces files in the same way as a manual update from the dashboard.

What happens if a virtual patch causes a false positive?

Navigate to VistoShield → Vuln Patcher → Virtual Patches, find the patch, and switch it to “Log Only” mode. Review the firewall logs to confirm the false positive, then report it via the support channel.

Can I exclude specific plugins from auto-updates?

Yes. From the Auto-Updates settings, you can add plugins and themes to an exclusion list. Excluded components will still be scanned and flagged, but updates must be applied manually.

How much disk space do backups use?

Each backup stores only the plugin or theme ZIP file, typically a few megabytes. The backup retention setting automatically cleans up old backups beyond the configured age.