steve/wp-healthcheck
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Detect cloaked versions for core and plugins

Browse Source 
Step 3 (Core) now does three independent lookups:
- Installed version (the truth, from $wp_version)
- Latest per WordPress (via get_core_updates — what WP_Downgrade can
  manipulate)
- Latest per wp.org (direct call to api.wordpress.org/core/version-check/1.7/
  cached 1h, can't be cloaked from the server side)

If 'Latest per WordPress' < 'Latest per wp.org', the finding is bumped
to bad with a CLOAKED detail message. The wp_downgrade_core_version
option is also surfaced verbatim so it's obvious where the pin lives.

Step 4 (Plugins) similarly:
- wp_org_info() now captures the version field from the WP.org plugins
  info API. Cache key bumped to wph_pi2_ so existing entries get
  re-fetched.
- For each plugin: installed version vs wp.org reported version.
- If installed < wp.org AND the WP update_plugins transient doesn't
  flag it, the row is bad with 'CLOAKED — WP says up-to-date'.
- Cloaked count surfaces in the summary.

Both steps also explicitly detect a roster of known cloaker plugins
(WP Downgrade, WP Rollback, Easy Updates Manager, Disable Updates
Manager, Stops Core/Theme/Plugin Updates, Companion Auto Update)
and warn when any are active, so the technician sees the framing
before diving into individual rows.

Smoke-tested with WP Downgrade installed and wp_downgrade_core_version
set: both findings fire correctly, target version is surfaced.
This commit is contained in:
Steve Hanlon
2026-06-12 10:46:18 +01:00
parent 8ff3a6ec31
commit 4e030ae5ee
2 changed files with 158 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

78
includes/steps/40-plugins.php
View File

@@ -29,16 +29,30 @@ return new class extends WPH_Step {
$f = [];
$abandoned = 0;
$removed = 0;
$update_avail = 0;
$update_avail = 0; // WP itself sees an update
$cloaked = 0; // wp.org says there's a newer version, WP doesn't
// Refresh update transient (no-op if recent)
// Refresh update transient (no-op if recent) — this is what WP sees,
// which may be filtered by WP Downgrade / WP Rollback / etc.
if (function_exists('wp_update_plugins')) wp_update_plugins();
$updates = get_site_transient('update_plugins');
$update_map = isset($updates->response) && is_array($updates->response) ? $updates->response : [];
// Detect known cloakers
$cloakers = $this->detect_cloakers();
if ($cloakers) {
$f[] = $this->finding(
'cloakers', 'warn',
'Update-cloaker plugins active',
implode(', ', $cloakers),
'Plugin update reporting may be filtered. The wp.org column below is fetched directly and cannot be cloaked.'
);
}
foreach ($plugins as $file => $meta) {
$slug = dirname($file);
if ($slug === '.' || $slug === '') $slug = basename($file, '.php');
$installed = (string) ($meta['Version'] ?? '');
$info = $this->wp_org_info($slug);
$detail_parts = [];
$level = 'ok';
@@ -54,50 +68,87 @@ return new class extends WPH_Step {
} elseif (is_array($info)) {
if (!empty($info['last_updated'])) {
$age_days = floor((time() - strtotime($info['last_updated'])) / DAY_IN_SECONDS);
$detail_parts[] = 'Last release ' . $age_days . ' day(s) ago (' . $info['last_updated'] . ')';
$detail_parts[] = 'Last release ' . $age_days . 'd ago';
if ($age_days > 365) {
$level = 'warn';
$abandoned++;
$detail_parts[] = 'no release in >12 months';
$detail_parts[] = '>12 mo';
}
}
if (!empty($info['active_installs'])) {
$detail_parts[] = number_format($info['active_installs']) . ' active installs';
}
}
if (isset($update_map[$file])) {
$level = 'warn';
$detail_parts[] = 'Update available → ' . ($update_map[$file]->new_version ?? '?');
$update_avail++;
// Compare installed vs wp.org reported version — un-cloakable truth.
if (!empty($info['version']) && $installed) {
$real_behind = version_compare($installed, (string) $info['version'], '<');
$wp_sees_update = isset($update_map[$file]);
if ($real_behind) {
$detail_parts[] = 'wp.org has ' . $info['version'];
$update_avail++;
if (!$wp_sees_update) {
$level = 'bad';
$detail_parts[] = 'CLOAKED — WP says up-to-date';
$cloaked++;
} else {
$level = 'warn';
}
} elseif ($wp_sees_update) {
// Edge case: WP transient says there's an update but we have it or newer.
$detail_parts[] = 'WP transient still flags an update';
$level = 'warn';
}
}
}
$f[] = $this->finding(
'plugin_' . sanitize_key($file),
$level,
$meta['Name'] ?? $file,
(string) ($meta['Version'] ?? ''),
$installed,
implode(' · ', $detail_parts)
);
}
// Summary at the top
array_unshift($f, $this->finding(
'summary', 'info',
'summary',
$cloaked ? 'bad' : 'info',
'Summary',
count($plugins) . ' plugins',
$update_avail . ' with updates · ' . $abandoned . ' not updated in 12 mo · ' . $removed . ' not in WP.org'
sprintf('%d with updates · %d cloaked · %d not updated in 12 mo · %d not in WP.org',
$update_avail, $cloaked, $abandoned, $removed)
));
return $f;
}
/** Detect plugins that can hide or manipulate version reporting. */
private function detect_cloakers(): array {
if (!function_exists('is_plugin_active')) require_once ABSPATH . 'wp-admin/includes/plugin.php';
$known = [
'wp-downgrade/wp-downgrade.php' => 'WP Downgrade',
'wp-rollback/wp-rollback.php' => 'WP Rollback',
'easy-updates-manager/wpmudev_install.php' => 'Easy Updates Manager',
'stops-core-theme-and-plugin-updates/stops-core-theme-and-plugin-updates.php' => 'Stops Core/Theme/Plugin Updates',
'disable-updates-manager/disable-updates-manager.php' => 'Disable Updates Manager',
'companion-auto-update/companion-auto-update.php' => 'Companion Auto Update',
];
$found = [];
foreach ($known as $file => $label) {
if (is_plugin_active($file)) $found[] = $label;
}
return $found;
}
/**
* Returns ['name' => ..., 'last_updated' => ..., 'active_installs' => ...]
* or 'not_in_repo' / 'removed' on failure. Cached 24h per slug via transient.
*/
private function wp_org_info(string $slug) {
$cache_key = 'wph_pi_' . md5($slug);
// v2: cache now includes 'version' field for cloak detection — fresh prefix
// so existing cached entries get re-fetched on the next refresh.
$cache_key = 'wph_pi2_' . md5($slug);
$cached = get_transient($cache_key);
if ($cached !== false) return $cached;
@@ -124,6 +175,7 @@ return new class extends WPH_Step {
}
$out = [
'name' => $data['name'] ?? $slug,
'version' => $data['version'] ?? null,
'last_updated' => $data['last_updated'] ?? null,
'active_installs' => $data['active_installs'] ?? null,
];