extuno
Every WordPress plugin update ships new PHP onto a public web server.
WordPress plugins run PHP on a public web server, so a compromised update can add a rogue administrator, drop a webshell, or start injecting SEO spam. Extuno diffs every release and reads the new PHP with static and AI analysis, then runs the plugin in a segmented sandbox to watch what it does at runtime.
WordPress plugin
Every finding is backed by evidence.
Each finding names the change, why it is dangerous, and the recommended action.
Rogue administrator
The sandbox watches the plugin create a hidden admin account at runtime and mail the credentials out.
Injected webshell
A file gains an eval() over request data, a remote-controlled shell.
SEO-spam injection
The plugin starts appending hidden links to the site footer.
A benign plugin poisoned in a later version
Extuno diffs the update, reads the new PHP, and flags the code that creates a hidden admin.
- + Vulnerability and secret-leak testing on every version
- + Static analysis reads the code without running it
- + Dynamic sandbox runs it live and records behavior
- + AI code analysis reads the full source and correlates the change against prior versions
Scan your first WordPress extension free.
5 free credits on signup. One credit per scan, no card required.
Common questions
Does Extuno support WordPress?
Yes. Extuno scans WordPress with static analysis, a dynamic sandbox, and AI code analysis, and diffs every version to catch one that was clean but poisoned through an update.
How does Extuno scan WordPress?
Extuno acquires the published WordPress artifact, reads it statically with 1100+ rules, runs it in a network-segmented sandbox, reviews the source with AI, and diffs it against the prior version. The finding names the file, the change, why it is dangerous, and the fix.
What does Extuno catch in WordPress?
Leaked secrets, obfuscated or malicious code, dangerous permissions and APIs, exfiltration and command-and-control behavior, and the headline signal: a version that turns malicious after an update.