Wordfence Now Authorized as a CVE Numbering Authority

Wordfence has been authorized by the Common Vulnerabilities and Exposures (CVE®) Program as a CNA (CVE Numbering Authority), which allows the company to directly assign CVE numbers for new vulnerabilities in WordPress core, plugins, and themes. The authority is granted by Mitre Corporation, a federally-funded US non-profit that manages research and development centers. Wordfence anticipates that the ability to create CVE assignments will expedite its security research. “As the Wordfence Threat Intelligence team continues to produce groundbreaking WordPress security research, Wordfence can more efficiently assign CVE IDs prior to publicly disclosing any vulnerabilities that our team discovers,” Wordfence threat analyst Chloe Chamberland said. “This means that a CVE ID will be immediately assigned with every vulnerability we discover rather than waiting for an assignment from an external CNA.” Not having to wait on a CVE ID is a major advantage for the company, especially when working with enterprise installations where WordPress is used in combination with other software. It also helps security personnel prioritize and act based on the potential severity of threats. “Our efforts to become a CNA had these individuals, institutions, and enterprise personnel in mind, as well as WordPress’ reputation as a whole,” Chamberland said. “Now, those…

…Full post on WP Tavern
Read Full