Managed Security Service / Vulnerability Management
The biggest WordPress risk
are the versions you're running.
WordPress core, libraries and many themes and plugins are open source and update constantly. They are the single largest attack surface on the internet. OwlEye treats version control as a frontline security control — not housekeeping.
v-scan
patched
core 6.6.2✓
yoast 23.4✓
wc 9.3.1✓
acf 6.3.6✓
elem 3.24✓
Open source moves fast. Attackers move faster.
Every WordPress site is a moving target — core, themes, plugins, and libraries push updates constantly. Miss one, and you become a CVE statistic. OwlEye runs disciplined version control across every component, every day.
N-1
Maximum drift on major versions across the entire stack.
N-3
Maximum drift on minor versions — enforced, audited, reported.
10d
Contractual remediation SLA from CVE disclosure to production patch.
Component Inventory
Six asset classes · zero exceptions
01
WordPress Core
Major + Minor + Security
Privilege escalation, RCE
WordPress.org · NVD
02
Themes
Vendor releases + custom forks
Stored XSS, file inclusion
Patchstack · Vendor feeds
03
Plugins
Weekly — sometimes daily
96.6% of all WP CVEs
WPScan · Patchstack
04
PHP Libraries
Composer & vendor bundles
Supply-chain injection
NVD · GitHub Advisory
05
JS Libraries
Bundled in themes/plugins
Prototype pollution, XSS
Snyk · npm Audit
06
Server & Stack
PHP, NGINX, MySQL, OS
Remote code execution
Vendor CVE · CISA KEV
of WordPress CVEs originate in third-party plugins, themes, and libraries.
of WordPress sites are running at least one component with a known vulnerability.
OwlEye contractual remediation SLA from CVE disclosure to regression-tested production patch.
Every layer. Inventoried, baselined, patched.
WordPress Core
Major, minor, and security releases ship from wordpress.org on an unpredictable cadence. We pin every estate to a known-good version and patch within 48 hours of any security release.
Themes (vendor & custom)
Themes ship arbitrary PHP and JS, often bundling outdated libraries. Custom forks frequently lose touch with upstream security fixes. We baseline both and remediate against vendor advisories.
Plugins
The single largest WordPress attack surface — 96.6% of disclosed CVEs originate here. Every plugin is inventoried, CVE-watched, and force-updated within our 10-business-day SLA.
PHP Libraries (Composer + vendored)
Bundled vendor directories often contain libraries years out of date. We extract the dependency tree of every plugin and theme and track each library against the CVE database.
JavaScript Libraries
jQuery, Lodash, Moment, and a thousand others ship inside themes and plugins. We surface client-side library versions, flag prototype pollution / XSS exposure, and require remediation.
Server, Runtime & OS
PHP, NGINX, MySQL/MariaDB, and the underlying OS are managed inside hardened OwlEye containers. Patched on the upstream vendor SLA — no exceptions, no unsupported versions.
Six steps. Repeated for every CVE. Forever.
Inventory
Onboarding produces a complete bill-of-materials for every WordPress estate: core, theme, plugins, vendored PHP/JS libraries, and runtime versions.
Baseline & Align
Every component is brought inside the N-1 major / N-3 minor envelope before continuous operations begin. Out-of-policy components are remediated, replaced, or written into a documented exception.
Continuous CVE Watch
We subscribe to NVD, Patchstack, WPScan, and vendor advisories. The moment a component on your stack appears, a remediation ticket is auto-opened against your account.
Regression Test in Staging
Patches are applied to a production-mirror staging environment and run through automated functional, visual, and accessibility regression suites before promotion.
Promote with Rollback
Production updates ship inside a controlled change window with one-click rollback. WAF virtual patches cover the gap if a fix cannot be safely promoted within the SLA.
Report & Attest
Monthly version reports show every component, its current version, the policy ceiling, and your time-to-patch. Audit-ready evidence for SOC 2, ISO 27001, HIPAA, and PCI DSS.
How we keep the platform — and your estate — hardened.
Patch management
We monitor regular security patches for WordPress. Because OwlEye is staffed by active members of the WordPress community, when an issue arises we patch it ahead of the fix landing in WordPress core.
Security testing
We perform regular internal security testing and engage third parties to run platform vulnerability assessments against the OwlEye platform.
Penetration testing
We continuously test our infrastructure for vulnerabilities and routinely engage independent third parties to run penetration tests against the platform.
Vulnerability notifications
Customize vulnerability alerts by notification channel and severity. Integrate notifications into your existing emergency response processes via chat, email, webhooks, and more.
Code and plugin scans
A bot scans code, plugins, and themes as part of pull requests opened in your application’s GitHub repository — surfacing potential security concerns before code reaches production.
Logging and auditing
We log activity at the application, web server, load balancer, database, and operating system layers, so security issues can be analyzed and investigated in real time.
Anti-spam
Easily filter spam from user-submitted content using our integrated Akismet anti-spam API.
Controlled changes
Application code is deployed through Kubernetes to Docker containers from version control onto a read-only file system, ensuring changes are only possible via the developer workflow.
Coordinated core WordPress updates
We alert all customers of upcoming WordPress updates and make sure you are on the latest version of the platform.
Want a free inventory of your WordPress estate?
We’ll produce a confidential bill-of-materials of every core, theme, plugin, and library you’re running — with each component scored against current CVE data.