Issue WP Toolkit reports plugin as 0.0 security risk yet Wordfence DB says it's 9.8 Critical..!

[pleskuser67553]

Server operating system version

AlmaLinux 9.8 (Olive Jaguar)

Plesk version and microupdate number

Plesk Obsidian 18.0.80 Update #7

I have a WordPress site on a server which I thought was vulnerable, yet WP Toolkit is giving it an overall 0.1 Security Risk, so I've been going about my other business with a false sense of security. Other external tools have since reconfirmed its critically vulnerable status

Local File Inclusion in WordPress RT-Theme 18 | Extensions Plugin

Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.

patchstack.com

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/rt18-extensions/rt-theme-18-extensions-24-unauthenticated-local-file-inclusion

I have tried:

• Scanning the site for malware with Imunify and Wordfence - no malware
• Verifying the WordPress core checksums - all green
• Detaching, deleting .wp-toolkit-ignore and rescanning for the affected site
• plesk ext wp-toolkit --clear-wpt-cache

After it is still reporting the same scores. The 9.8 CVE is highlighted below which WP Toolkit claims is "Low". This seems to me to be a very serious bug in WP Toolkit's security features

By the way, LayerSlider WP is also being reported with a 6.4 CVE on Wordfence https://www.wordfence.com/threat-in...cated-contributor-stored-cross-site-scripting

 

[Martin Dias]

Hello,
Thank you for the report, we are already aware of this issue and plan to improve this in a nearest WP-Toolkit release.
At the moment the toolkit uses security ranking based on its mostly on the EPSS score, and we will improve the calculations to also reflect more the CVSS scores