CoffeeDevs CVE Check for PHP

CoffeeDevs CVE Check for PHP shows site administrators whether the PHP version running their server is affected by known vulnerabilities (CVEs) and whether it is still supported.

The check runs under Tools → CVE Check for PHP and compares the installed PHP version with:

• the CVE entries of the National Vulnerability Database (NVD) for exactly this PHP version, including severity (CVSS) and the PHP release that fixes each CVE,
• the latest release of the same PHP branch (php.net),
• the official support dates of the branch (active support, security fixes only, end of life; endoflife.date).

The newest relevant CVE is highlighted, and the result is also shown in Tools → Site Health.

Features

• Clear overall status: no known issues, review recommended, or action required.
• List of CVEs with severity, publication date and “fixed in” version.
• Entries that NVD lists for all PHP versions are shown separately as broad matches and do not influence the result.
• Notice for distribution builds (Debian, Ubuntu, …), where fixes are often backported without a version change.
• Optional weekly automatic check (opt-in, disabled by default).
• Optional NVD API key for higher rate limits.
• Translations: English and German (de_DE and de_DE_formal) included.
• No tracking, no ads, no frontend output, no credits or links on your website.

Limits

The check is based on the PHP version number only. Linux distributions often fix vulnerabilities without changing the version number, so CVEs may be listed that have already been fixed on your server. For branches that reached end of life, new vulnerabilities are often no longer assessed by NVD. The plugin does not test the server for exploits and does not guarantee that a server is secure.

External services

This plugin connects to the following external services. Requests are only sent when an administrator clicks “Run check now” on the plugin page or has enabled the weekly automatic check. No request is sent on activation, on page views of your website, or by Site Health.

The address of your website, user data and other site information are not transmitted. A neutral user agent (CoffeeDevs-CVE-Check-for-PHP/<version>) is used instead of the WordPress default, which would contain the site URL. As with every web request, the services see the IP address of your server.

1. php.net – PHP release information

   • Purpose: latest release of the installed PHP branch and the list of supported branches.
   • Data sent: the PHP branch (e.g. 8.3).
   • Endpoint: https://www.php.net/releases/index.php
   • Terms of use / privacy: https://www.php.net/privacy.php

2. endoflife.date – support dates

   • Purpose: release, active support and security support dates of the PHP branches.
   • Data sent: none beyond the request itself.
   • Endpoint: https://endoflife.date/api/php.json
   • Website and terms: https://endoflife.date/ (data licensed under MIT, see https://github.com/endoflife-date/endoflife.date)

3. National Vulnerability Database (NVD), operated by NIST – CVE data

   • Purpose: CVEs that affect the installed PHP version.
   • Data sent: the PHP version (as CPE name, e.g. cpe:2.3:a:php:php:8.3.10:*:*:*:*:*:*:*) and, only if you saved one, your NVD API key.
   • Endpoint: https://services.nvd.nist.gov/rest/json/cves/2.0
   • Terms of use: https://nvd.nist.gov/developers/terms-of-use
   • Privacy policy: https://www.nist.gov/privacy-policy

This product uses the NVD API but is not endorsed or certified by the NVD.