Today we are incredibly excited to announce that Wordfence is launching an entirely free vulnerability database API and web interface, available for commercial use by hosting companies, security organizations, threat analysts, security researchers, and the WordPress user community. This is part of a larger project known as Wordfence Intelligence Community Edition.
This year at Blackhat in Las Vegas, Wordfence launched Wordfence Intelligence, an enterprise product providing organizations with data feeds derived from the attack telemetry received from Wordfence users with one goal in mind: to further secure the Web by enabling enterprises and network defenders with the ability to implement threat intelligence in a way that will better secure their infrastructure and customers. Wordfence Intelligence includes malware signatures, IP threat feeds and a malware hash feed to enable enterprises to deploy the data at the network and server level.
Wordfence Intelligence Community Edition is a set of data available free for the community to use, and it includes an enterprise quality vulnerability database, and an API that provides a full up-to-date download in JSON format, completely free with no registration required. Wordfence are investing heavily in this database by growing the team, maintaining and curating the existing data, and adding new vulnerabilities as soon as they are discovered.
There is also no limitation on the use of this data, other than an attribution requirement for vulnerabilities sourced from MITRE, and an attribution requirement for Wordfence own vulnerabilities. Each vulnerability record includes the data you need to provide this attribution on your user interface.
By giving the data away for free, and allowing commercial use, Wordfence are acting as a catalyst for innovation in the vulnerability scanning space. Individual developers no longer have an expensive barrier to entry if they want to implement a new kind of vulnerability scanning software for the community, thus fostering innovation and improving the security of the WordPress community as a whole.
To this end, Wordfence are launching with security researcher profile pages a security researcher leaderboard, and each vulnerability will link to the relevant researcher who discovered the vulnerability also adding the ability for researchers to edit their own profile page so that they can add links to their resume or personal website. Expect this in the coming weeks.
Wordfence will be launching web hooks in the coming weeks that will proactively and programmatically alert users and applications to the release of a new vulnerability. This provides real-time awareness of a new vulnerability, and makes the time between announcement and mitigation of a new vulnerability approach zero.
Defiant Inc and the Wordfence team are investing heavily in this vulnerability database by actively recruiting talented security analysts to triage inbound vulnerabilities, and researchers to discover new vulnerabilities in WordPress core, plugins and themes.