Summary

Fixes security issue where wp plugin verify-checksums skipped plugin directories without valid main plugin files, allowing malware to hide in these "shadow" directories.

Changes

1. Enhanced Plugin Detection (get_all_plugin_names())

• Scans wp-content/plugins/ filesystem for all plugin directories
• Includes both plugins with valid headers AND directories without headers
• Security measures:
  • Directory readability validation
  • Symlink exclusion to prevent traversal attacks
  • Proper error handling

2. Enhanced Plugin Fetcher (UnfilteredPlugin::get())

• Detects plugin directories even when main files are missing
• Constructs conventional plugin file path for verification
• Path traversal and symlink protection via realpath() validation

3. Version Detection Fallback (fetch_version_from_wp_org())

• When the main plugin file is missing and version cannot be determined locally, queries the WordPress.org API via WpOrgApi::get_plugin_info() to get the current stable version
• Assumes the installed version matches the current stable release from WordPress.org
• Issues a clear warning about this assumption: "Could not determine the version of plugin {slug} from its files. Assuming the current stable version ({version}) from WordPress.org."
• Returns false (skips verification) if the plugin is not found on WordPress.org or the API call fails

4. User Warnings

• Warning when main plugin file is missing during verification
• Warning when version is assumed from WordPress.org stable release
• Helps administrators identify potential security issues

5. Test Coverage

• Comprehensive test scenario for missing main file case
• Uses explicit --version flag for single-plugin verification
• Validates renamed files are detected as checksum errors
• Validates warnings are shown for both missing file and WP.org version assumption
• Tests both single plugin and --all flag scenarios

Security Impact

Before: Attackers could hide malicious files in plugin directories by removing/renaming the main plugin file. These directories were completely ignored during checksum verification.

After: All plugin directories are verified against WordPress.org checksums, regardless of whether they have valid plugin headers. Malware cannot hide using this technique.

Usage Note

When a plugin's main file is missing and the version cannot be determined, the command automatically queries WordPress.org for the current stable version and verifies against that. You can also explicitly provide the version using the --version flag:

wp plugin verify-checksums plugin-name --version=1.2.3

Backward Compatibility

✅ Fully backward compatible - existing plugins with valid headers work exactly as before
✅ Only affects detection of plugin directories without valid main files (previously ignored)
✅ No breaking changes to API or command syntax

Files Changed

• src/Checksum_Plugin_Command.php
• src/WP_CLI/Fetchers/UnfilteredPlugin.php
• features/checksum-plugin.feature

• Fixes Verification checks skipped when plugin missing main PHP file #121

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.