Plugin Vulnerability Triage SOP

Plugin Vulnerability Triage SOP
Work the disclosure feed like a queue, not a panic.

— Step 1: Cross-reference installed plugins against a CVE feed (WPScan / Patchstack) daily.
— Step 2: For each hit, classify: actively exploited, auth-required, or theoretical.
— Step 3: Patch actively-exploited and unauthenticated RCE within hours — that's the emergency tier.
— Step 4: For unpatched criticals, apply a virtual patch via WAF rule until the vendor ships.
— Step 5: Deactivate AND delete abandoned plugins (no update in 12 months) — deactivated code still ships files.
— Step 6: Snapshot before every update; smoke-test after.
— Verify: the vulnerable version no longer appears in your inventory.

Run this every time.