phpwarden 2.4.0__tar.gz → 2.5.0__tar.gz

{phpwarden-2.4.0 → phpwarden-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phpwarden
-Version: 2.4.0
+Version: 2.5.0
 Summary: PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS; blocks exploits inside PHP (shield). Offline, zero dependencies.
 Author: oroma-alfred
 License-Expression: Apache-2.0
@@ -142,10 +142,25 @@ files / high or critical `code` and `probe` findings (`probe` also on any
 known-exploited finding) / anything to act on now or this week (`assess`),
 `2` possibly exposed (`scan`), `3` PHP version unknown (`scan`), `4` input
 error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
-error. Full table: `phpwarden --help`.
-
-
-## New in 2.4.0, 2.3.0 and 2.2
+error. `1` also means `feed update` failed. Full table: `phpwarden --help`.
+
+
+## New in 2.5.0, 2.4.0, 2.3.0 and 2.2
+
+- **2.5.0: live check behind a login.** On a site that has proved ownership,
+  `probe --cookie` / `--cookie-file` / `--header` (or a saved test-account login
+  on the dashboard, one same-origin login POST) repeats a few read-only requests
+  signed in: on WordPress, `/wp-admin/` (version) and `plugins.php` (plugin
+  versions). Logout, delete and nonce URLs are never requested; credential values
+  are never printed or logged, are stored encrypted (AES-256-GCM) and are deleted
+  with the project. Use a low-privilege test account. [Docs](https://phpwarden.io/docs#probe-auth).
+- **2.5.0: PhpStorm plugin** in `integrations/phpstorm-plugin`, at parity with
+  the VS Code extension. Not on JetBrains Marketplace yet: build it and install
+  from disk.
+- **2.5.0: `phpwarden code` resolves table names fixed in the code** (constants,
+  `define()`, Laravel `config()`, Symfony parameters, concatenation, `$wpdb->prefix`
+  and core table properties, Eloquent `$table`), closing the dynamic-table-name
+  limit of 2.4.0. Benchmark results are unchanged.
 
 - **2.4.0: `phpwarden code` follows data through the database and callbacks.**
   Request data saved with raw SQL, `$wpdb`, Eloquent, the query builder or
@@ -178,13 +193,13 @@ error. Full table: `phpwarden --help`.
   includes, redirects and HTTP clients, with a trace per finding (SARIF
   `codeFlows`). Models Laravel, Symfony and WordPress: routes with no auth check,
   mass assignment, raw Blade/Twig output, IDOR hints, CSRF exclusions, nonces.
-  Follows data stored in the session or WordPress options (second-order).
-  89 rules. On the same pinned apps it found more than Semgrep and Psalm with far
+  Follows data stored in the session or WordPress options, and (2.4.0; names resolved in 2.5.0) data saved to database tables (second-order), matched by table name: literal names, constants, Laravel config / Symfony parameters, `$wpdb->prefix` + name, `$wpdb->posts` etc. and Eloquent `$table` are resolved; table names built from run-time data are not matched.
+  89 rules. In our published comparison (2026-11-15) it found more than Semgrep, Psalm and Snyk Code, with far
   fewer findings on clean framework code ([comparison](https://github.com/oroma-alfred/phpwarden/tree/main/bench/sast-compare-2026-11)).
 - **`phpwarden shield`**: one PHP file loaded before your app that blocks exploit
   attempts against the exploited vulnerabilities this site actually has, scoped
   to their entry points. Logs until you promote rules (7-day burn-in, explicit
-  flag), fails open, has a kill switch, about 0.07 ms per request. Not an edge
+  flag), fails open, has a kill switch, about 0.1 ms per request in our benchmark. Not an edge
   WAF: no DDoS, bot or TLS handling.
 - **`phpwarden assess`**: one ranked list from every view of a site: installed
   versions, your code, the live site from outside, and the access log, with the
@@ -199,9 +214,11 @@ error. Full table: `phpwarden --help`.
 - **Coverage commitment**: in-scope CISA KEV entries are in the maintained feed
   within 24 hours of listing, checked on every rebuild and published at
   https://phpwarden.io/feeds/kev-status.json. Details: https://phpwarden.io/sla
-- **Editors**: a VS Code extension in `integrations/vscode` (build and install
-  the `.vsix` from that folder; not on the Marketplace yet) and PhpStorm External Tool steps in
-  `integrations/phpstorm`.
+- **Editors**: a VS Code extension on the
+  [Marketplace](https://marketplace.visualstudio.com/items?itemName=phpwarden.phpwarden)
+  (`code --install-extension phpwarden.phpwarden`; source in `integrations/vscode`) and a PhpStorm plugin
+  in `integrations/phpstorm-plugin` (not on JetBrains Marketplace yet: build it and
+  use Install Plugin from Disk; External Tool steps in `integrations/phpstorm`).
 
 ## Replacing Wordfence CLI
 
@@ -267,7 +284,7 @@ see [phpwarden/laravel](https://packagist.org/packages/phpwarden/laravel).
 ```yaml
 repos:
   - repo: https://github.com/oroma-alfred/phpwarden
-    rev: v2.4.0        # pin to a tag with `pre-commit autoupdate`
+    rev: v2.5.0        # pin to a tag with `pre-commit autoupdate`
     hooks:
       - id: phpwarden-deps
         # args: ["--no-reachability"]   # faster: skip the reachability pass
@@ -284,7 +301,7 @@ The bundled community feed (2026.11.14.2 in this release) works forever, offline
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
   and 146 PHP engine/FPM CVEs, including hand-curated entries with per-branch
-  fixed versions, exposure conditions and detection signatures. About 19,800 carry an
+  fixed versions, exposure conditions and detection signatures. About 18,200 distinct vulnerabilities carry an
   EPSS score; 54 distinct vulnerabilities were in KEV when this feed was built.
 - **License-independent by construction.** Every source is open or
   public-domain (OSV, NVD, FriendsOfPHP, php-src release notes, CISA KEV, FIRST EPSS). No commercial

{phpwarden-2.4.0 → phpwarden-2.5.0}/README.md

@@ -120,10 +120,25 @@ files / high or critical `code` and `probe` findings (`probe` also on any
 known-exploited finding) / anything to act on now or this week (`assess`),
 `2` possibly exposed (`scan`), `3` PHP version unknown (`scan`), `4` input
 error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
-error. Full table: `phpwarden --help`.
-
-
-## New in 2.4.0, 2.3.0 and 2.2
+error. `1` also means `feed update` failed. Full table: `phpwarden --help`.
+
+
+## New in 2.5.0, 2.4.0, 2.3.0 and 2.2
+
+- **2.5.0: live check behind a login.** On a site that has proved ownership,
+  `probe --cookie` / `--cookie-file` / `--header` (or a saved test-account login
+  on the dashboard, one same-origin login POST) repeats a few read-only requests
+  signed in: on WordPress, `/wp-admin/` (version) and `plugins.php` (plugin
+  versions). Logout, delete and nonce URLs are never requested; credential values
+  are never printed or logged, are stored encrypted (AES-256-GCM) and are deleted
+  with the project. Use a low-privilege test account. [Docs](https://phpwarden.io/docs#probe-auth).
+- **2.5.0: PhpStorm plugin** in `integrations/phpstorm-plugin`, at parity with
+  the VS Code extension. Not on JetBrains Marketplace yet: build it and install
+  from disk.
+- **2.5.0: `phpwarden code` resolves table names fixed in the code** (constants,
+  `define()`, Laravel `config()`, Symfony parameters, concatenation, `$wpdb->prefix`
+  and core table properties, Eloquent `$table`), closing the dynamic-table-name
+  limit of 2.4.0. Benchmark results are unchanged.
 
 - **2.4.0: `phpwarden code` follows data through the database and callbacks.**
   Request data saved with raw SQL, `$wpdb`, Eloquent, the query builder or
@@ -156,13 +171,13 @@ error. Full table: `phpwarden --help`.
   includes, redirects and HTTP clients, with a trace per finding (SARIF
   `codeFlows`). Models Laravel, Symfony and WordPress: routes with no auth check,
   mass assignment, raw Blade/Twig output, IDOR hints, CSRF exclusions, nonces.
-  Follows data stored in the session or WordPress options (second-order).
-  89 rules. On the same pinned apps it found more than Semgrep and Psalm with far
+  Follows data stored in the session or WordPress options, and (2.4.0; names resolved in 2.5.0) data saved to database tables (second-order), matched by table name: literal names, constants, Laravel config / Symfony parameters, `$wpdb->prefix` + name, `$wpdb->posts` etc. and Eloquent `$table` are resolved; table names built from run-time data are not matched.
+  89 rules. In our published comparison (2026-11-15) it found more than Semgrep, Psalm and Snyk Code, with far
   fewer findings on clean framework code ([comparison](https://github.com/oroma-alfred/phpwarden/tree/main/bench/sast-compare-2026-11)).
 - **`phpwarden shield`**: one PHP file loaded before your app that blocks exploit
   attempts against the exploited vulnerabilities this site actually has, scoped
   to their entry points. Logs until you promote rules (7-day burn-in, explicit
-  flag), fails open, has a kill switch, about 0.07 ms per request. Not an edge
+  flag), fails open, has a kill switch, about 0.1 ms per request in our benchmark. Not an edge
   WAF: no DDoS, bot or TLS handling.
 - **`phpwarden assess`**: one ranked list from every view of a site: installed
   versions, your code, the live site from outside, and the access log, with the
@@ -177,9 +192,11 @@ error. Full table: `phpwarden --help`.
 - **Coverage commitment**: in-scope CISA KEV entries are in the maintained feed
   within 24 hours of listing, checked on every rebuild and published at
   https://phpwarden.io/feeds/kev-status.json. Details: https://phpwarden.io/sla
-- **Editors**: a VS Code extension in `integrations/vscode` (build and install
-  the `.vsix` from that folder; not on the Marketplace yet) and PhpStorm External Tool steps in
-  `integrations/phpstorm`.
+- **Editors**: a VS Code extension on the
+  [Marketplace](https://marketplace.visualstudio.com/items?itemName=phpwarden.phpwarden)
+  (`code --install-extension phpwarden.phpwarden`; source in `integrations/vscode`) and a PhpStorm plugin
+  in `integrations/phpstorm-plugin` (not on JetBrains Marketplace yet: build it and
+  use Install Plugin from Disk; External Tool steps in `integrations/phpstorm`).
 
 ## Replacing Wordfence CLI
 
@@ -245,7 +262,7 @@ see [phpwarden/laravel](https://packagist.org/packages/phpwarden/laravel).
 ```yaml
 repos:
   - repo: https://github.com/oroma-alfred/phpwarden
-    rev: v2.4.0        # pin to a tag with `pre-commit autoupdate`
+    rev: v2.5.0        # pin to a tag with `pre-commit autoupdate`
     hooks:
       - id: phpwarden-deps
         # args: ["--no-reachability"]   # faster: skip the reachability pass
@@ -262,7 +279,7 @@ The bundled community feed (2026.11.14.2 in this release) works forever, offline
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
   and 146 PHP engine/FPM CVEs, including hand-curated entries with per-branch
-  fixed versions, exposure conditions and detection signatures. About 19,800 carry an
+  fixed versions, exposure conditions and detection signatures. About 18,200 distinct vulnerabilities carry an
   EPSS score; 54 distinct vulnerabilities were in KEV when this feed was built.
 - **License-independent by construction.** Every source is open or
   public-domain (OSV, NVD, FriendsOfPHP, php-src release notes, CISA KEV, FIRST EPSS). No commercial

{phpwarden-2.4.0 → phpwarden-2.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phpwarden"
-version = "2.4.0"
+version = "2.5.0"
 description = "PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS; blocks exploits inside PHP (shield). Offline, zero dependencies."
 readme = "README.md"
 requires-python = ">=3.8"

{phpwarden-2.4.0 → phpwarden-2.5.0}/src/phpwarden/__init__.py

@@ -6,4 +6,4 @@ real-world exploitation (CISA KEV, then EPSS, then CVSS), and can watch PHP-FPM
 for active exploitation. The engine and the bundled feed are open; free users
 get weekly feed updates, and a subscription adds the feed rebuilt twice a day.
 """
-__version__ = "2.4.0"
+__version__ = "2.5.0"

{phpwarden-2.4.0 → phpwarden-2.5.0}/src/phpwarden/cli.py

@@ -455,8 +455,32 @@ def _probe(args):
               f"  3. A tag in the homepage <head>:\n       <meta name=\"phpwarden-verify\" content=\"{token}\">\n\n"
               f"Without it, probe only reads the homepage response (passive mode).")
         return 0
+    auth = None
+    if args.cookie or args.cookie_file or args.header:
+        if args.passive:
+            sys.stderr.write("error: --cookie/--cookie-file need the active checks; drop --passive\n")
+            return 4
+        try:
+            raw = list(args.cookie or [])
+            if args.cookie_file:
+                with open(args.cookie_file, encoding="utf-8") as fh:
+                    raw.append(fh.read())
+            cookies = {}
+            for r in raw:
+                cookies.update(pr.parse_cookies(r))
+            headers = {}
+            for hv in args.header or []:
+                k, sep, v = hv.partition(":")
+                if not sep:
+                    raise ValueError("header must be 'Name: value'")
+                headers[k.strip()] = v.strip()
+            auth = pr.Auth(cookies=cookies, headers=headers)
+        except (OSError, ValueError) as e:     # messages never contain the cookie value
+            sys.stderr.write(f"error: could not read the cookie: {e.__class__.__name__}"
+                             f"{'' if isinstance(e, OSError) else ': ' + str(e)}\n")
+            return 4
     res = pr.run_probe(url, token=token, active=False if args.passive else None,
-                       max_requests=args.max_requests)
+                       max_requests=args.max_requests, auth=auth)
     if args.json:
         print(json.dumps(res, indent=2))
     elif _fmt(args) == "sarif":
@@ -883,6 +907,14 @@ def main(argv=None):
                     help="show how to verify ownership of the site, then exit")
     pb.add_argument("--passive", action="store_true", help="read the homepage response only")
     pb.add_argument("--max-requests", type=int, default=60, help="request budget (default 60)")
+    pb.add_argument("--cookie", action="append", metavar="NAME=VALUE",
+                    help="session cookie for the signed-in check (repeatable; used only after ownership is "
+                         "verified, only on that site, GET/HEAD only; never printed). Use a low-privilege test account")
+    pb.add_argument("--cookie-file", metavar="FILE",
+                    help="read cookies from FILE (name=value lines or a Netscape cookies.txt); keeps them out of "
+                         "shell history")
+    pb.add_argument("--header", action="append", metavar="'NAME: VALUE'",
+                    help="extra header sent with the signed-in requests (repeatable; never printed)")
     pb.add_argument("--json", action="store_true", help="machine-readable JSON output")
     _format_arg(pb)
     pb.set_defaults(func=_probe)

{phpwarden-2.4.0 → phpwarden-2.5.0}/src/phpwarden/probe.py

@@ -3,7 +3,8 @@
 SAFETY RULES (these are the design, not suggestions):
 
 * GET/HEAD only. No POST, no payloads, no fuzzing, no brute force, no login or
-  auth attempts, no form submission. Nothing is ever written to the target.
+  auth attempts, no form submission (except the opt-in signed-in check below:
+  one login POST). Nothing is ever written to the target.
 * No crawling. Only the homepage plus a FIXED list of well-known paths is ever
   requested (see EXPOSURE_CHECKS / ENDPOINT_CHECKS below). Links found on a
   page are never followed; the only page-derived requests are
@@ -23,6 +24,15 @@ SAFETY RULES (these are the design, not suggestions):
   in an exposed .env, the NUMBER of enumerable users) and never values.
 * Every exposure is content-confirmed; status 200 alone never counts, and a
   random nonexistent path is requested first to detect soft-404 sites.
+
+AUTHENTICATED CHECK (optional, see `Auth`): the owner can hand the probe a
+session cookie, or a TEST account's login (one form POST to obtain cookies).
+It runs only after ownership is verified. The login POST is the only non-GET
+request the probe ever makes, and only to the verified origin. Requests that
+carry credentials go only to the verified origin (same scheme, host, port);
+a redirect elsewhere is refused, and no URL matching a logout / delete /
+state-changing pattern (or carrying a nonce/CSRF parameter) is requested
+while signed in. Credential values are scrubbed from the whole result.
 """
 import difflib
 import hashlib
@@ -83,8 +93,9 @@ class Response:
         return self.body.decode("utf-8", errors="replace")
 
 
-def default_fetch(url, method="GET", timeout=TIMEOUT, max_bytes=MAX_BYTES):
-    """Single HTTP request, no redirect following. Returns a Response."""
+def default_fetch(url, method="GET", timeout=TIMEOUT, max_bytes=MAX_BYTES, headers=None, data=None):
+    """Single HTTP request, no redirect following. Returns a Response.
+    `headers`/`data` are only passed by the authenticated check."""
     parts = urlsplit(url)
     path = parts.path or "/"
     if parts.query:
@@ -95,7 +106,9 @@ def default_fetch(url, method="GET", timeout=TIMEOUT, max_bytes=MAX_BYTES):
     else:
         conn = http.client.HTTPConnection(parts.hostname, parts.port or 80, timeout=timeout)
     try:
-        conn.request(method, path, headers={"User-Agent": USER_AGENT, "Accept": "*/*"})
+        h = {"User-Agent": USER_AGENT, "Accept": "*/*"}
+        h.update(headers or {})
+        conn.request(method, path, body=data, headers=h)
         r = conn.getresponse()
         body = r.read(max_bytes) if method != "HEAD" else b""
         return Response(r.status, r.getheaders(), body, url)
@@ -103,10 +116,129 @@ def default_fetch(url, method="GET", timeout=TIMEOUT, max_bytes=MAX_BYTES):
         conn.close()
 
 
+# --------------------------------------------------------------------------- #
+# Authenticated check: credentials and the rules for using them
+# --------------------------------------------------------------------------- #
+# Never requested while signed in: anything that could end the session or
+# change state. Matched against the full URL (path and query), case-insensitive.
+UNSAFE_URL_RE = re.compile(
+    r"log[-_ ]?out|log[-_ ]?off|sign[-_ ]?out|sign[-_ ]?off|delete|remove|destroy|trash|"
+    r"unsubscribe|deactivate|uninstall|disable|revoke|purge|reset|drop|wipe|"
+    r"[?&](?:_wpnonce|nonce|_token|csrf[^=&]*)=", re.I)
+_FORBIDDEN_HEADERS = {"host", "content-length", "transfer-encoding", "connection", "user-agent",
+                      "content-type", "cookie"}
+_TOKEN_RE = re.compile(r"^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$")
+
+
+def is_unsafe_url(url) -> bool:
+    """True for URLs the authenticated check must never request."""
+    return bool(UNSAFE_URL_RE.search(url or ""))
+
+
+def parse_cookies(text) -> dict:
+    """'a=1; b=2' (or one name=value per line; Netscape cookies.txt lines are
+    understood too) -> {name: value}. Raises ValueError on junk. The error
+    message never contains the input."""
+    out = {}
+    for line in (text or "").replace("\r", "").split("\n"):
+        line = line.strip()
+        if line.startswith("#HttpOnly_"):
+            line = line[len("#HttpOnly_"):]
+        elif not line or line.startswith("#"):
+            continue
+        cols = line.split("\t")
+        if len(cols) == 7:                       # Netscape cookies.txt
+            if not _TOKEN_RE.match(cols[5].strip()):
+                raise ValueError("bad cookie name")
+            out[cols[5].strip()] = cols[6].strip()
+            continue
+        for part in line.split(";"):
+            part = part.strip()
+            if not part:
+                continue
+            name, sep, value = part.partition("=")
+            name = name.strip()
+            if not sep or not _TOKEN_RE.match(name):
+                raise ValueError("cookie must be name=value")
+            out[name] = value.strip()
+    if not out:
+        raise ValueError("no cookie given")
+    return out
+
+
+class Auth:
+    """Credentials for the authenticated check. Either `cookies` (+ optional
+    extra `headers`) or `login` = {url, user_field, pass_field, username,
+    password}. repr() never shows a value."""
+    def __init__(self, cookies=None, headers=None, login=None):
+        self.cookies = dict(cookies or {})
+        self.headers = {}
+        for k, v in (headers or {}).items():
+            k, v = str(k).strip(), str(v).strip()
+            if not _TOKEN_RE.match(k) or k.lower() in _FORBIDDEN_HEADERS or "\r" in v or "\n" in v:
+                raise ValueError("header not allowed")
+            self.headers[k] = v
+        self.login = dict(login) if login else None
+        if self.login:
+            for f in ("url", "user_field", "pass_field", "username", "password"):
+                if not str(self.login.get(f) or ""):
+                    raise ValueError(f"login needs {f}")
+        if not self.cookies and not self.login:
+            raise ValueError("give a cookie or a login")
+
+    @property
+    def method(self):
+        return "login" if self.login else "cookie"
+
+    def secret_values(self) -> list:
+        vals = list(self.cookies.values()) + list(self.headers.values())
+        if self.login:
+            vals += [self.login["password"], self.login["username"]]
+        return [v for v in vals if v and len(v) >= 3]
+
+    def __repr__(self):
+        return f"<Auth {self.method} [redacted]>"
+    __str__ = __repr__
+
+
+def scrub(obj, secret_values):
+    """Replace every occurrence of a secret value in a JSON-like structure."""
+    vals = sorted({v for v in secret_values if v}, key=len, reverse=True)
+    if not vals:
+        return obj
+
+    def one(x):
+        if isinstance(x, str):
+            for v in vals:
+                if v in x:
+                    x = x.replace(v, "[redacted]")
+            return x
+        if isinstance(x, dict):
+            return {one(k): one(v) for k, v in x.items()}
+        if isinstance(x, (list, tuple)):
+            return [one(v) for v in x]
+        return x
+    return one(obj)
+
+
+def _origin(url):
+    p = urlsplit(url)
+    scheme = (p.scheme or "").lower()
+    try:
+        port = p.port
+    except ValueError:
+        port = -1
+    return (scheme, (p.hostname or "").lower(), port or (443 if scheme == "https" else 80))
+
+
 class BudgetExceeded(Exception):
     pass
 
 
+class _Refused(Exception):
+    pass
+
+
 class _Session:
     """Enforces request cap, delay, total time cap and same-host redirects."""
     def __init__(self, base_url, fetch, max_requests, delay):
@@ -117,8 +249,22 @@ class _Session:
         self.count = 0
         self.start = time.monotonic()
         self.notes = []
-
-    def _one(self, url, method):
+        self.origin = _origin(base_url)
+        self.auth = None          # an Auth, set only after ownership is verified
+        self.jar = {}
+        self._login_post = False
+
+    def _one(self, url, method, data=None):
+        if self.auth is not None:
+            # credentials only ever go to the verified origin, read-only
+            if _origin(url) != self.origin:
+                raise _Refused("request to another origin refused while signed in")
+            if is_unsafe_url(url):
+                raise _Refused("skipped while signed in (logout or state-changing URL)")
+            if method not in ("GET", "HEAD") and not (method == "POST" and self._login_post):
+                raise _Refused("only GET/HEAD while signed in")
+        elif method not in ("GET", "HEAD"):
+            raise _Refused("only GET/HEAD")
         if self.count >= self.max_requests:
             raise BudgetExceeded("request cap reached")
         if time.monotonic() - self.start > TOTAL_TIME_CAP:
@@ -126,7 +272,25 @@ class _Session:
         if self.count and self.delay:
             time.sleep(self.delay)
         self.count += 1
-        return self.fetch(url, method=method, timeout=TIMEOUT, max_bytes=MAX_BYTES)
+        if self.auth is None:
+            return self.fetch(url, method=method, timeout=TIMEOUT, max_bytes=MAX_BYTES)
+        h = dict(self.auth.headers)
+        if self.jar:
+            h["Cookie"] = "; ".join(f"{k}={v}" for k, v in self.jar.items())
+        if data is not None:
+            h["Content-Type"] = "application/x-www-form-urlencoded"
+        r = self.fetch(url, method=method, timeout=TIMEOUT, max_bytes=MAX_BYTES, headers=h, data=data)
+        for sc in r.all("set-cookie"):           # same origin by construction
+            name, _, rest = sc.partition("=")
+            name, value = name.strip(), rest.split(";", 1)[0].strip()
+            if not _TOKEN_RE.match(name):
+                continue
+            low = sc.lower()
+            if not value or value == "deleted" or "max-age=0" in low or "01 jan 1970" in low:
+                self.jar.pop(name, None)
+            else:
+                self.jar[name] = value
+        return r
 
     def get(self, url, follow=True, method="GET"):
         """GET url, following <=3 same-host redirects. Returns Response or None."""
@@ -135,6 +299,12 @@ class _Session:
             hops = 0
             while follow and r.status in (301, 302, 303, 307, 308) and r.header("location"):
                 nxt = urljoin(r.url, r.header("location"))
+                if self.auth is not None and _origin(nxt) != self.origin:
+                    self.notes.append("signed in: redirect to another origin refused")
+                    return r
+                if self.auth is not None and is_unsafe_url(nxt):
+                    self.notes.append("signed in: redirect to a logout or state-changing URL not followed")
+                    return r
                 if (urlsplit(nxt).hostname or "").lower() != self.host:
                     self.notes.append(f"redirect to another host not followed: {urlsplit(nxt).hostname}")
                     return r
@@ -146,6 +316,9 @@ class _Session:
             return r
         except BudgetExceeded:
             raise
+        except _Refused as e:
+            self.notes.append(f"{urlsplit(url).path or '/'}: {e}")
+            return None
         except (OSError, http.client.HTTPException, ValueError) as e:
             self.notes.append(f"{urlsplit(url).path or '/'}: {type(e).__name__}")
             return None
@@ -705,6 +878,102 @@ def _run_active(sess, root, fp, feed, findings):
                                "Disable autoindex (Options -Indexes)."))
 
 
+_WP_ADMIN_VER_RE = re.compile(r'id=["\']footer-upgrade["\'][^>]*>\s*(?:<[^>]+>\s*)*Version\s+([\d.]+)', re.I)
+_WP_PLUGIN_ROW_RE = re.compile(r'<tr[^>]+data-slug=["\']([a-z0-9_\-.]+)["\'][^>]*>(.*?)</tr>', re.I | re.S)
+_WP_ROW_VER_RE = re.compile(r'Version\s+([\d][\w.\-]*)', re.I)
+
+
+def _login(sess, auth):
+    """One form POST to the login URL (same origin only); cookies from the
+    response go into the jar. Returns True when new cookies were set."""
+    lg = auth.login
+    url = lg["url"]
+    if _origin(url) != sess.origin:
+        sess.notes.append("login refused: the login URL is not on the verified site")
+        return False
+    if is_unsafe_url(url):
+        sess.notes.append("login refused: the login URL looks like a logout or state-changing URL")
+        return False
+    sess.get(url, follow=False)                        # pre-login cookies (GET)
+    form = {lg["user_field"]: lg["username"], lg["pass_field"]: lg["password"]}
+    if urlsplit(url).path.endswith("wp-login.php"):    # WordPress refuses logins without its test cookie
+        sess.jar.setdefault("wordpress_test_cookie", "WP%20Cookie%20check")
+        form.setdefault("testcookie", "1")
+    from urllib.parse import urlencode
+    before = dict(sess.jar)
+    sess._login_post = True
+    try:
+        r = sess._one(url, "POST", data=urlencode(form).encode())
+    except _Refused as e:
+        sess.notes.append(f"login: {e}")
+        return False
+    except (OSError, http.client.HTTPException, ValueError) as e:
+        sess.notes.append(f"login request failed: {type(e).__name__}")
+        return False
+    finally:
+        sess._login_post = False                      # never another POST
+    new = {k for k, v in sess.jar.items() if before.get(k) != v and k != "wordpress_test_cookie"}
+    if r.status >= 400 or not new:
+        sess.notes.append(f"login did not set a session cookie (HTTP {r.status}); signed-in checks skipped")
+        return False
+    return True
+
+
+def _run_authenticated(sess, url, root, fp, findings):
+    """Signed-in GETs: the homepage again, and on WordPress the dashboard and
+    the plugin list (both read-only pages). Returns the summary dict."""
+    info = {"used": True, "method": sess.auth.method, "signed_in": False, "pages": [], "seen_signed_in": []}
+    before = {"wordpress": fp["wordpress"], "php": fp["php"], "plugins": dict(fp["plugins"]),
+              "themes": dict(fp["themes"])}
+    r = sess.get(url)
+    if r is not None and r.status == 200:
+        info["pages"].append(urlsplit(r.url).path or "/")
+        _fingerprint_headers(r, fp)
+        _fingerprint_html(r.text, fp)
+    if "wordpress" in fp["frameworks"] or (sess.auth.login and "wp-login.php" in sess.auth.login["url"]):
+        r = sess.get(urljoin(root, "wp-admin/"))
+        if r is None or r.status != 200 or "wp-login.php" in (r.url or "") or 'id="loginform"' in r.text:
+            sess.notes.append("signed in: wp-admin/ did not accept the session (expired cookie or wrong login?)")
+        else:
+            info["signed_in"] = True
+            info["pages"].append("/wp-admin/")
+            _fingerprint_html(r.text, fp)
+            m = _WP_ADMIN_VER_RE.search(r.text)
+            if m and not fp["wordpress"]:
+                fp["wordpress"] = m.group(1)
+            r2 = sess.get(urljoin(root, "wp-admin/plugins.php"))
+            if r2 is not None and r2.status == 200 and "data-slug" in r2.text:
+                info["pages"].append("/wp-admin/plugins.php")
+                n = 0
+                for slug, row in _WP_PLUGIN_ROW_RE.findall(r2.text):
+                    vm = _WP_ROW_VER_RE.search(row)
+                    if vm and not fp["plugins"].get(slug.lower()):
+                        fp["plugins"][slug.lower()] = vm.group(1)
+                    n += 1
+                findings.append(_f("auth-account-can-list-plugins", "auth", "low",
+                                   "The test account can open the plugin list",
+                                   f"Signed in, /wp-admin/plugins.php listed {n} plugins. That page needs an "
+                                   f"administrator-level role; use a lower-privilege test account.",
+                                   urljoin(root, "wp-admin/plugins.php"),
+                                   "Give the live check an account with the lowest role that can sign in "
+                                   "(e.g. Subscriber)."))
+    elif r is not None and r.status == 200:
+        info["signed_in"] = True
+    for k in ("wordpress", "php"):
+        if fp[k] and not before[k]:
+            info["seen_signed_in"].append(f"{k} {fp[k]}")
+    for kind in ("plugins", "themes"):
+        for slug, v in fp[kind].items():
+            if v and not before[kind].get(slug):
+                info["seen_signed_in"].append(f"{kind[:-1]} {slug} {v}")
+    if info["seen_signed_in"]:
+        findings.append(_f("auth-versions-visible-signed-in", "auth", "info",
+                           "Versions visible only when signed in",
+                           "; ".join(info["seen_signed_in"][:20]), url,
+                           "Matched against the feed like any other version; nothing to fix by itself."))
+    return info
+
+
 def is_public_host(host) -> bool:
     """True when every address `host` resolves to is a public internet address.
 
@@ -752,9 +1021,11 @@ def local_token(host, home=None) -> str:
 
 
 def run_probe(url, *, token=None, active=None, feed=None, max_requests=60, delay=0.3,
-              fetch=None, tls_check=None):
+              fetch=None, tls_check=None, auth=None):
     """Probe `url`. active=None: active if ownership verifies; active=True: require
-    verification (refused otherwise); active=False: passive only."""
+    verification (refused otherwise); active=False: passive only.
+    auth: an `Auth`; used only after ownership verifies, after the anonymous
+    active checks. Its values are scrubbed from the result."""
     if "://" not in url:
         url = "https://" + url
     p = urlsplit(url)
@@ -766,6 +1037,7 @@ def run_probe(url, *, token=None, active=None, feed=None, max_requests=60, delay
     fp = {"php": None, "wordpress": None, "plugins": {}, "themes": {}, "frameworks": []}
     findings, ownership, mode = [], {"verified": False, "method": None}, "passive"
     incomplete = False
+    authinfo = {"used": False}
 
     try:
         # Passive: the single homepage GET, redirects NOT followed.
@@ -791,6 +1063,14 @@ def run_probe(url, *, token=None, active=None, feed=None, max_requests=60, delay
                     if h2 is not None:
                         _fingerprint_html(h2.text, fp)
                 _run_active(sess, root, fp, feed, findings)
+                if auth is not None:
+                    sess.auth = auth
+                    sess.jar = dict(auth.cookies)
+                    authinfo = {"used": True, "method": auth.method, "signed_in": False}
+                    if auth.login is None or _login(sess, auth):
+                        authinfo = _run_authenticated(sess, url, root, fp, findings)
+        if auth is not None and not ownership["verified"]:
+            sess.notes.append("signed-in check refused: ownership not verified")
         if active and not ownership["verified"]:
             sess.notes.append("active mode refused: ownership not verified")
     except BudgetExceeded as e:
@@ -808,13 +1088,18 @@ def run_probe(url, *, token=None, active=None, feed=None, max_requests=60, delay
     summary = {s: sum(1 for f in findings if f["severity"] == s) for s in SEV_ORDER}
     summary["exploited"] = sum(1 for f in findings if f.get("known_exploited"))
     summary["total"] = len(findings)
-    return {"tool": "phpwarden-probe", "version": __version__, "target": url, "mode": mode,
+    sess.auth, sess.jar = None, {}
+    result = {"tool": "phpwarden-probe", "version": __version__, "target": url, "mode": mode,
             "ownership": ownership, "requests_made": sess.count, "fingerprint": fp,
             "findings": findings, "summary": summary, "notes": sess.notes,
             # False when the request or time budget ran out before every check ran:
             # "nothing found" on an incomplete run is not a clean result.
             "complete": not incomplete,
-            "feed_version": getattr(feed, "feed_version", None)}
+            "feed_version": getattr(feed, "feed_version", None),
+            "authenticated": authinfo}
+    if auth is not None:
+        result = scrub(result, auth.secret_values())
+    return result
 
 
 # --------------------------------------------------------------------------- #
@@ -837,6 +1122,11 @@ def to_text(result):
         bits.append("frameworks: " + ", ".join(fp["frameworks"]))
     if bits:
         lines.append("fingerprint: " + "; ".join(bits))
+    a = result.get("authenticated") or {}
+    if a.get("used"):
+        lines.append(f"signed-in check ({a.get('method')}): "
+                     + ("signed in; pages: " + ", ".join(a.get("pages") or []) if a.get("signed_in")
+                        else "not signed in (see notes)"))
     lines.append("")
     # A version header such as "X-Powered-By: PHP/8.1.2" can match dozens of
     # engine CVEs, most only "possibly" (SAPI and OS are invisible from