Alert catalog

The alert catalog documents the SIEM events Vulnity can show for connected WordPress sites.

Use these pages to understand what each alert means, why it matters, and what response steps are recommended.

Summary

Alert	Technical ID	Maximum severity
Brute force attack	brute_force	Critical
File editor access modification	file_editor_used	Critical
PHP file upload	php_upload	Critical
Plugin change detection	plugin_changes	High
Plugin/theme auto-update	plugin_update · theme_update	Info
Security scanner detection	scanner_detection	Critical
Suspicious query detection	suspicious_query	Critical
Theme change detection	theme_changes	High
User account management	user_management	High
WordPress core update or downgrade	core_update	High

Available alerts

• Brute force attack
• File editor access modification
• PHP file upload
• Plugin change detection
• Plugin/theme auto-update
• Security scanner detection
• Suspicious query detection
• Theme change detection
• User account management
• WordPress core update or downgrade

Note

XML-RPC is not a detection in this catalog: Vulnity Security can block the xmlrpc.php endpoint as a hardening option. See Hardening.