I built a free WordPress plugin to help with EU Cyber Resilience Act compliance

#php #security #wordpress #opensource

The problem

The EU Cyber Resilience Act (CRA) deadline is September 11, 2026 —
less than 5 months away.

After that date, WordPress plugin developers and site owners in the EU
must follow formal vulnerability handling procedures. Non-compliant
products can be removed from the EU market. Fines reach up to
€15 million or 2.5% of global annual turnover.

Most WordPress site owners have no idea which of their plugins are
outdated or have known vulnerabilities.

What I built

CRA Scanner — a free WordPress plugin that scans your active
plugins and shows a clear compliance status for each one.

It checks:

When each plugin was last updated (6+ months = warning, 12+ = risk)
Known vulnerabilities via WPScan API — filtered to show only issues affecting your current installed version, not historical ones
Whether PHP version requirements are declared

The result is a simple dashboard:

![CRA Scanner screenshot]

Why I built it

I couldn't find a simple free tool that just scans your plugins and
gives you a clear picture. Most solutions are either paid, overly
complex, or focused on documentation rather than actual plugin health.