Vulnerability Data Feed

The Vulnerability Data Feed provides the most-current information about vulnerabilities impacting WordPress. This feed requires no authentication, and is publicly available for free for personal and commercial use. By using the Vulnerability Data Feed API you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

If you have any questions on how to get started, please reach out to us at wfi-support@wordfence.com.

Accessing the Vulnerability Data Feed

Two versions of the Vulnerability Data Feed are available to support different use cases:

• Production Feed – Detailed records that have been fully analyzed by the Wordfence team
• Scanner Feed – Minimal format that provides detection information for newly discovered vulnerabilities that are actively being researched in addition to those included in the Production Feed

Both corresponding endpoints return the complete feed and do not accept any additional parameters.

Production Feed

The Production Feed provides data about vulnerabilities for which complete details are available. This may not include all records that are available in the Scanner Feed.

GET /api/intelligence/v2/vulnerabilities/production
Host: www.wordfence.com

Example Record

(See Data Format for details)

{
	"848ccbdc-c6f1-480f-a272-cd459e706713": {
        "id": "848ccbdc-c6f1-480f-a272-cd459e706713",
        "title": "Example Vulnerability",
        "software": [
            {
                "type": "plugin",
                "name": "Example Plugin",
                "slug": "example",
                "affected_versions": {
                    "1.0.0 - 1.2.3": {
                        "from_version": "1.0.0",
                        "from_inclusive": true,
                        "to_version": "1.2.3",
                        "to_inclusive": true
                    }
                },
                "patched": true,
                "patched_versions": [
                    "1.2.4"
                ],
                "remediation": "Update to version 1.2.4, or a newer patched version"
            }
        ],
        "informational": false,
        "description": "An example vulnerability",
        "references": [
            "http:\/\/www.wordfence.com/threat-intel/vulnerabilities/example"
        ],
        "cwe": {
            "id": 80,
            "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
            "description": "The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as <, >, and & that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."
        },
        "cvss": {
            "vector": "CVSS:3.1\/A:N\/I:L\/C:L\/S:U\/UI:N\/PR:N\/AC:L\/AV:N",
            "score": 6.5,
            "rating": "Medium"
        },
        "cve": "CVE-1998-1000",
        "cve_link": "https:\/\/www.cve.org\/CVERecord?id=CVE-1998-1000",
        "researchers": [
            "A. Researcher"
        ],
        "published": "1998-01-09 00:00:00",
        "updated": "2022-08-05 20:14:05",
        "copyrights": {
            "message": "This record contains material that is subject to copyright",
            "defiant": {
                "notice": "Copyright 2012-2023 Defiant Inc.",
                "license": "Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you, include a hyperlink to this vulnerability record, and reproduce Defiant's copyright designation and this license in any such copy.",
                "license_url": "https:\/\/www.wordfence.com\/wti-community-edition-terms-and-conditions\/"
            },
            "mitre": {
                "notice": "Copyright 1999-2022 The MITRE Corporation",
                "license": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE\u00ae). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.",
                "license_url": "https:\/\/www.cve.org\/Legal\/TermsOfUse"
             }
        }
    },
    ...
}

Scanner Feed

The Scanner Feed contains only detection information and includes new vulnerabilities that do not yet have enough information to be included in the Production Feed.

GET /api/intelligence/v2/vulnerabilities/scanner
Host: www.wordfence.com

Example Record

(See Data Format for details)

{
    "848ccbdc-c6f1-480f-a272-cd459e706713": {
        "id": "848ccbdc-c6f1-480f-a272-cd459e706713",
        "title": "Example Vulnerability",
        "software": [
            {
                "type": "plugin",
                "name": "Example Plugin",
                "slug": "example",
                "affected_versions": {
                    "1.0.0 - 1.2.3": {
                        "from_version": "1.0.0",
                        "from_inclusive": true,
                        "to_version": "1.2.3",
                        "to_inclusive": true
                    }
                },
                "patched": true,
                "patched_versions": [
                    "1.2.4"
                ],
        "informational": false,
        "references": [
            "http:\/\/www.wordfence.com/threat-intel/vulnerabilities/example"
        ],
            }
        ],
        "published": "1998-01-09 00:00:00"
        "copyrights": {
            "message": "This record contains material that is subject to copyright",
            "defiant": {
                "notice": "Copyright 2012-2023 Defiant Inc.",
                "license": "Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you, include a hyperlink to this vulnerability record, and reproduce Defiant's copyright designation and this license in any such copy.",
                "license_url": "https:\/\/www.wordfence.com\/wti-community-edition-terms-and-conditions\/"
            }
    },
    ...
}

Data Format

Both versions of the Vulnerability Data Feed are provided as JSON and follow the same basic format, though the Production Feed contains additional fields.

The root element in the JSON is an object where the keys are UUIDs assigned by Wordfence to each vulnerability. This allows flexibility in parsing the feed; it can easily be loaded into either a map (keyed by UUID) or just a sequential array, depending on how the data is to be used. The value is an object containing details about the corresponding vulnerability.

Record Fields

Software Format

An array of affected software is specified for each vulnerability across all feeds. Each value in this array is an object with the following fields describing the affected software and version information:

Affected Version Format

Affected version information is provided as an object with a string representation of the version as a key. This string may be a single version, an inclusive range, or an interval (specified using parentheses or square brackets to notate open or closed intervals, respectively). The value of an object with the following fields representing a range of versions:

Note that an asterisk (*) is a special value that denotes any version. It is only meaningful when it is the only character in the string and it cannot be combined with other versions values (i.e. 1.* would match the asterisk literally rather than matching 1.0). It may appear in either the from_version or to_version fields.

CWE Format

The Common Weakness Enumeration (CWE) defines standardized identifiers for common types of vulnerabilities.

CVSS Format

The Common Vulnerability Scoring System (CVSS) provides a framework for rating the severity of vulnerabilities. The Vulnerability Data Feed may include both CVSS v3.0 and CVSS v3.1 formatted records.

Date Format

Date/time values are provided as strings in the following format: YYYY-MM-DD hh:mm:ss

• YYYY – 4 digit year
• MM – 2 digit year with leading zeroes
• DD – 2 digit month with leading zeros
• hh – 2 digit hour with leading zeroes
• mm – 2 digit minute with leading zeroes
• ss – 2 digit second with leading zeroes

All time values are UTC unless otherwise specified.

Copyright Format

When any party has copyright claims to vulnerability data, a copyrights field will be included with details about the relevant party and its claims.

MITRE Attribution Requirement

Any company or individual who uses our vulnerability database API needs to display the MITRE copyright claims included in that vulnerability record for any MITRE vulnerabilities that they display to their end user.