Issue WP Toolkit incorrect vulnerability and version reports

[TurnRound]

Server operating system version

AlmaLinux 9.5 (Teal Serval)

Plesk version and microupdate number

Plesk Obsidian 18.0.66 Update #2,

Today I received an email from Plesk notifying me of new vulnerabilities in one of my WordPress sites.

However, upon checking these vulnerabilities out, they were for old versions of plugins and WordPress core, and even for some plugins I've not got installed anymore.

WP Toolkit seems to be mis-identifying the currently installed versions of plugins and WordPress, and even remembering no longer installed plugins. It shows the wrong version numbers of plugins and WordPress in the Plesk UI and offers to update them, even though in reality they are already up-to-date.

How do I fix this? I tried clearing the WP Toolkit cache with this command

plesk ext wp-toolkit --clear-wpt-cache

but it made no difference.

Thank you.

 

[Evgeny]

Hi,
If you manage assets somewhere out of WP-Toolkit, by default WP Toolkit updates site's cache on daily basis, so you can see outdated info during a day.

So during that day if a new vulnerability is published -> you will receive the email, even if that asset was updated or removed (without WP-Toolkit).

Is this your case? Could you say, how do you manage assets?

P.S. --clear-wpt-cache has no sense in this case because it cleans wp-toolkit own cache, not site's cache. You need to use --clear-cache command instead.

 

[TurnRound]

Yes, I have seen the issue that assets that are updated independently of WP-Toolkit are not reported as being up-to-date until the next day. However, this was reporting out of date assets from months ago.

Looking into it further I found an old backup copy of the domains httpdocs (web root) directory in the directory above httpdocs. It seems this is where WP-Toolkit was finding out-of-date plugins and the WordPress installation. So WP-Toolkit must be scanning the httpdocs parent directory and its child directories for assets, and reporting those as being part of the main site. I'm not sure if this is the intending behaviour but it is resulting in files not within httpdocs as being flagged as out-of-date.

 

[Evgeny]

WP-Toolkit works with files on fs, so if something looks like WordPress it may be registered in WP-Toolkit as a site (if "scan" was run).

If you "detach" this "old-backup" site and it will never be added back again and never cause such notifications.

 

[TurnRound]

This "old backup" site wasn't appearing in the WP-Toolkit UI in Plesk as a separate site, so couldn't be detached from there. Only the main (correct) site in httpdocs was showing, however, deleting the backup site and refreshing the main site has removed the incorrect plugin & WordPress versions and it is now showing as everything up-to-date.

Thank you.