VulnCue

VulnCue scans your WordPress from the inside, something an external

scanner can’t do with the same precision: an exact inventory of installed

plugins and themes, outdated core, an unsupported PHP version, uncustomized

php security keys, an active file editor, an exposed “admin” user,

env,

git), and more.

VulnCue also checks your exact PHP version against PHP2Shell

(CVE-2026-109618 / CVE-2026-109619), the two critical, unauthenticated

remote-code-execution vulnerabilities patched in October 2026 — accurately,

because the check reads PHP_VERSION directly inside your own WordPress

instead of guessing from a header your hosting might hide (which is the

best a purely external scanner, including our own free online checker at

com/herramientas/comprobador-php2shell, can ever do).

All of these checks are 100% free, with no need to create an account or

give your email. If you want an email alert when a new vulnerability (CVE)

affects one of your installed plugins, you can connect a free account from

com/) — optional, never required to

use the plugin.

VulnCue also includes its own free, built-in two-factor authentication

(2FA) — no extra plugin needed. Any user activates it in under 2 minutes

from their own profile by scanning a QR code with an authenticator app

(Google Authenticator, Authy, Microsoft Authenticator…); administrators can

also require it for specific roles, with a configurable grace period so

nobody is locked out by surprise, plus one-time backup codes and an

php kill switch. It never affects Application

Passwords, the REST API or XML-RPC. See the Frequently Asked Questions

section below for details.

External services

By default, this plugin sends no data to external servers. All checks

php constants, the

public folder’s file listing). The two-factor authentication feature is

100% local as well: the secret, the backup codes and the code check never

leave your WordPress, and the QR code is drawn in your own browser with no

network call at all.

Six exceptions, all of which can be turned off or only trigger on your

explicit action (the first three from the plugin’s screen; the fourth and

fifth only activate if you connect an account yourself; the sixth only if

you choose to send it):

• Checks that make the site send a request to itself: XML-RPC

php ), user enumeration via the REST API ( /wp-json/wp/v2/users ),

SSL/TLS certificate expiry and trust (two HTTPS connections to the site’s

own domain), directory listing on wp-content/uploads/, and whether the

homepage reveals the WordPress version in the <meta name="generator">

tag. None of these requests go out to VulnCue or any third party — it’s

your own WordPress talking to itself to check how it responds. The whole

group can be disabled with the “Include checks that make this site send a

request to itself” checkbox.

• Known vulnerability check (enabled by default, no account or email

com the list of installed plugins and

themes (only the technical name and version, never personal data or

anything about your site) to check them against VulnCue’s public CVE

catalog. Can be disabled with the “Check installed plugins/themes against

VulnCue’s public vulnerability catalog” checkbox.

• Core integrity verification (enabled by default, no account or email

org (WordPress’s own official

server, not VulnCue’s) to get the public checksums for your WordPress

version and check that the core files haven’t been modified. Only the

WordPress version and language are sent, never anything about your site.

Can be disabled with the “Check WordPress core integrity” checkbox.

• Account connection (optional, the only one that sends your email): if

you choose to enter your email to connect a free account, the plugin sends

com, to

create your account and be able to email you about new CVEs. Privacy

html

• Scheduled auto-scan + inventory report (only if you connected an

account): every hour, WP-Cron checks (sending only your connection key)

whether a new automatic scan is due — every 7 days on the free plan, every

day on a paid plan; the hourly check only shortens the wait for the first

scan after connecting, it doesn’t increase the actual frequency. When it’s

due, besides scanning your site it sends the

list of installed plugins and themes (technical name and version, never

personal data) so it can email you if any of them has a new vulnerability

— each alert is sent only once per vulnerability. Also, once your account

is connected, you’ll get a weekly email with your current risk level and

com).

If you haven’t connected an account, none of this happens and scanning

stays fully manual (“Scan again”).

• Deactivation survey (optional): when you deactivate the plugin you can

say why. Choosing “Skip” sends nothing. Writing something and confirming

com the site’s URL, the reason, and the WordPress/PHP/plugin

versions — never your email or any other personal data.