=== JAZ-X PHP Security Guardian ===
Contributors: jazxinnovation
Tags: php, security, vulnerability, monitoring, health-check
Requires at least: 6.0
Requires PHP: 7.4
Tested up to: 7.1
Stable tag: 1.0.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Read-only PHP runtime security advisory monitoring and WordPress maintenance checks.

== Description ==

JAZ-X PHP Security Guardian is a free administrator-only security advisory dashboard. It helps site owners check whether their PHP version meets the upstream fixes published on October 21, 2026 for CVE-2026-109618 and CVE-2026-109619.

Features:

* Shows PHP runtime version and compares it to the published patched releases for PHP 8.2, 8.3, 8.4, and 8.5.
* Warns administrators when their PHP release is below the upstream fix threshold.
* Provides links to official PHP security guidance.
* Shows cached WordPress core, theme, and plugin update counts.
* Shows WP_DEBUG and PHP display_errors configuration status.
* Lets administrators record a hosting provider's written backport or mitigation statement without treating it as independently verified.
* Optionally sends administrator emails when a potentially affected PHP runtime is newly detected or its reported version changes, using WordPress cron.
* Keeps all checks read-only; no automatic file modifications, remote scans, or PHP version changes.

Important limits:

* This plugin does NOT patch PHP vulnerabilities or block exploit traffic. Some exploits can run before WordPress loads.
* A version-number comparison alone cannot determine whether a host has vendor backports or external mitigations.
* A patched PHP version does not imply a WordPress site is entirely secure.
* The included CVE thresholds are a reviewed static snapshot, not a live vulnerability database. Future advisories require plugin updates.
* WordPress cron depends on site activity and is not a guaranteed exact-time security alert mechanism.

== Installation ==

1. Upload the plugin ZIP using Plugins > Add New > Upload Plugin.
2. Activate JAZ-X PHP Security Guardian.
3. Open Tools > PHP Security Guardian.
4. Review the PHP report and contact your hosting provider for any vendor-specific patch/backport confirmation.
5. Optionally save a hosting response and configure email alerts.

== Frequently Asked Questions ==

= Does this plugin fix CVE-2026-109618 and CVE-2026-109619? =

No. Only a security-patched PHP runtime (including correctly applied, vendor-supported backports) addresses the underlying problem. This plugin is a monitoring and guidance tool.

= Is the PHP version warning proof my host is exploitable? =

No. Some hosts use security backports or other controls which a WordPress plugin cannot verify. Ask your provider for a written statement and prioritize a supported patched runtime.

= Does it send any site information to an outside service? =

No. This version has no external telemetry or vulnerability scanning API calls. WordPress' own built-in update checking operates separately. Optional alert emails go to the site's configured administrator address.

= Does it modify PHP or WordPress settings? =

No. Checks are read-only, except plugin preferences and alert state stored locally in the WordPress options table.

== Changelog ==

= 1.0.2 =
* Match translation text domain to WordPress.org assigned plugin slug. No changes to monitoring or settings.


= 1.0.1 =
* Added WordPress.org readme compatibility header and language directory.
* Documented read-only success notice nonce exception for static analysis.


= 1.0.0 =
* Initial PHP advisory dashboard for the two October 2026 critical vulnerabilities.
* Added version threshold check, administrator warning, cached update signals, host notes, and optional daily email alerts.
