Vulnerability Data Feed

The Vulnerability Data Feed provides the most-current information about vulnerabilities impacting WordPress. This feed is publicly available for free for personal and commercial use, with token-based authentication for secure access. By using the Vulnerability Data Feed API you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

If you have any questions on how to get started, please reach out to us at wfi-support@wordfence.com.

Accessing the Vulnerability Data Feed

Two versions of the Vulnerability Data Feed are available to support different use cases:

• Production Feed – Detailed records that have been fully analyzed by the Wordfence team
• Scanner Feed – Minimal format that provides information useful for detection only

Both corresponding endpoints return the complete feed and do not accept any additional parameters.

Authentication

Both the Production Feed and Scanner Feed require authentication to return results. All requests to these APIs must include a valid API Key in the Authorization header of the request:

Authorization: Bearer [YOUR_API_KEY]

To obtain an API key, you must have a Wordfence.com account. Once registered and signed in, proceed to the Integrations section of your Account, where you can create an API key for use with the Vulnerability Data Feed. Your API key will only be displayed on screen once, so be sure to copy it once generated. You can regenerate your key at any time if needed.

Usage Limits

Even with a valid API key, requests to the Vulnerability Data Feed API are subject to usage limits. If your application is requesting the feed too many times in a short period, it will receive a 429 response code from the API. If you require a higher usage limit for your application, please contact us by email at wfi-support@wordfence.com with your request, making sure to include a reason for needing the higher limit for our team to review.

Production Feed

The Production Feed provides data about vulnerabilities for which complete details are available.

GET /api/intelligence/v3/vulnerabilities/production
Host: www.wordfence.com
Authorization: Bearer [YOUR_API_KEY]

Example Record

(See Data Format for details)

{
	"848ccbdc-c6f1-480f-a272-cd459e706713": {
        "id": "848ccbdc-c6f1-480f-a272-cd459e706713",
        "title": "Example Vulnerability",
        "software": [
            {
                "type": "plugin",
                "name": "Example Plugin",
                "slug": "example",
                "affected_versions": {
                    "1.0.0 - 1.2.3": {
                        "from_version": "1.0.0",
                        "from_inclusive": true,
                        "to_version": "1.2.3",
                        "to_inclusive": true
                    }
                },
                "patched": true,
                "patched_versions": [
                    "1.2.4"
                ],
                "remediation": "Update to version 1.2.4, or a newer patched version"
            }
        ],
        "informational": false,
        "description": "An example vulnerability",
        "references": [
            "http:\/\/www.wordfence.com/threat-intel/vulnerabilities/example"
        ],
        "cwe": {
            "id": 80,
            "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
            "description": "The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as <, >, and & that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."
        },
        "cvss": {
            "vector": "CVSS:3.1\/A:N\/I:L\/C:L\/S:U\/UI:N\/PR:N\/AC:L\/AV:N",
            "score": 6.5,
            "rating": "Medium"
        },
        "cve": "CVE-1998-1000",
        "cve_link": "https:\/\/www.cve.org\/CVERecord?id=CVE-1998-1000",
        "researchers": [
            "A. Researcher"
        ],
        "published": "1998-01-09 00:00:00",
        "updated": "2022-08-05 20:14:05",
        "copyrights": {
            "message": "This record contains material that is subject to copyright",
            "defiant": {
                "notice": "Copyright 2012-2023 Defiant Inc.",
                "license": "Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you, include a hyperlink to this vulnerability record, and reproduce Defiant's copyright designation and this license in any such copy.",
                "license_url": "https:\/\/www.wordfence.com\/wti-community-edition-terms-and-conditions\/"
            },
            "mitre": {
                "notice": "Copyright 1999-2022 The MITRE Corporation",
                "license": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE\u00ae). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.",
                "license_url": "https:\/\/www.cve.org\/Legal\/TermsOfUse"
             }
        }
    },
    ...
}

Scanner Feed

The Scanner Feed contains only detection information and is intended for use by vulnerability scanning applications that do not need to display the full technical information about vulnerabilities to end users.

GET /api/intelligence/v3/vulnerabilities/scanner
Host: www.wordfence.com
Authorization: Bearer [YOUR_API_KEY]

Example Record

(See Data Format for details)

{
    "848ccbdc-c6f1-480f-a272-cd459e706713": {
        "id": "848ccbdc-c6f1-480f-a272-cd459e706713",
        "title": "Example Vulnerability",
        "software": [
            {
                "type": "plugin",
                "name": "Example Plugin",
                "slug": "example",
                "affected_versions": {
                    "1.0.0 - 1.2.3": {
                        "from_version": "1.0.0",
                        "from_inclusive": true,
                        "to_version": "1.2.3",
                        "to_inclusive": true
                    }
                },
                "patched": true,
                "patched_versions": [
                    "1.2.4"
                ],
        "informational": false,
        "references": [
            "http:\/\/www.wordfence.com/threat-intel/vulnerabilities/example"
        ],
            }
        ],
        "published": "1998-01-09 00:00:00"
        "copyrights": {
            "message": "This record contains material that is subject to copyright",
            "defiant": {
                "notice": "Copyright 2012-2023 Defiant Inc.",
                "license": "Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you, include a hyperlink to this vulnerability record, and reproduce Defiant's copyright designation and this license in any such copy.",
                "license_url": "https:\/\/www.wordfence.com\/wti-community-edition-terms-and-conditions\/"
            }
    },
    ...
}

Data Format

Both versions of the Vulnerability Data Feed are provided as JSON and follow the same basic format, though the Production Feed contains additional fields.

The root element in the JSON is an object where the keys are UUIDs assigned by Wordfence to each vulnerability. This allows flexibility in parsing the feed; it can easily be loaded into either a map (keyed by UUID) or just a sequential array, depending on how the data is to be used. The value is an object containing details about the corresponding vulnerability.

Record Fields

Software Format

An array of affected software is specified for each vulnerability across all feeds. Each value in this array is an object with the following fields describing the affected software and version information:

Affected Version Format

Affected version information is provided as an object with a string representation of the version as a key. This string may be a single version, an inclusive range, or an interval (specified using parentheses or square brackets to notate open or closed intervals, respectively). The value of an object with the following fields representing a range of versions:

Note that an asterisk (*) is a special value that denotes any version. It is only meaningful when it is the only character in the string and it cannot be combined with other versions values (i.e. 1.* would match the asterisk literally rather than matching 1.0). It may appear in either the from_version or to_version fields.

CWE Format

The Common Weakness Enumeration (CWE) defines standardized identifiers for common types of vulnerabilities.

CVSS Format

The Common Vulnerability Scoring System (CVSS) provides a framework for rating the severity of vulnerabilities. The Vulnerability Data Feed may include both CVSS v3.0 and CVSS v3.1 formatted records.

Date Format

Date/time values are provided as strings in the following format: YYYY-MM-DD hh:mm:ss

• YYYY – 4 digit year
• MM – 2 digit year with leading zeroes
• DD – 2 digit month with leading zeros
• hh – 2 digit hour with leading zeroes
• mm – 2 digit minute with leading zeroes
• ss – 2 digit second with leading zeroes

All time values are UTC unless otherwise specified.

Copyright Format

When any party has copyright claims to vulnerability data, a copyrights field will be included with details about the relevant party and its claims.

MITRE Attribution Requirement

Any company or individual who uses our vulnerability database API needs to display the MITRE copyright claims included in that vulnerability record for any MITRE vulnerabilities that they display to their end user.