5.0.6 Release

README.md

@@ -1,5 +1,11 @@
 # Wordfence CLI
 
+> [!WARNING]
+> Wordfence CLI is no longer available for new Free or Premium licenses.
+> The Free version of WF-CLI will reach end-of-life on October 14th, 2026. After that date, the Free version will no longer be supported.
+> Existing Wordfence CLI Premium licenses will remain active and supported until their current license term expires. Premium licenses will not be renewed after expiration, and no new Premium licenses will be issued going forward.
+> Current Premium customers may continue to access support, documentation, and applicable downloads through the end of their active license term.
+
  Wordfence CLI is an open source, high performance, multi-process security scanner, written in Python, that quickly scans network filesystems to detect PHP/other malware and WordPress vulnerabilities. CLI is parallelizable, can be scheduled, can accept input via pipe, and can pipe output to other commands.
 
 ## Installation
@@ -26,10 +32,6 @@ If you'd like to install Wordfence CLI manually or use CLI for development, you
 	- `requests` >= 2.3
 	- `mysql-connector-python` >= 8.0
 
-### Obtaining a license
-
-Visit [https://www.wordfence.com/products/wordfence-cli/](https://www.wordfence.com/products/wordfence-cli/) to obtain a license to download our signature set.
-
 ## Usage
 
 You can run `wordfence help` for a full list of options that can be passed to Wordfence CLI. Read more about the [configuration options](docs/Configuration.md) that can be passed to Wordfence CLI.

docs/Configuration.md

@@ -5,9 +5,8 @@ Configuration can be set through command line arguments, or configured globally
 ## `wordfence configure` Command Line Arguments
 
 - `-o`, `--overwrite`: Overwrite any existing configuration file without prompting
-- `-r`, `--request-license`: Automatically request a free license without prompting
 - `-w`, `--workers`: Specify the number of worker processes to use for malware scanning
-- `-D`, `--default`: Automatically accept the default values for any options that are not explicitly specified. This will also result in a free license being requested when terms are accepted.
+- `-D`, `--default`: Automatically accept the default values for any options that are not explicitly specified
 
 ## Global Command Line Arguments
 

docs/FAQs.md

@@ -2,7 +2,7 @@
 
 #### How do I get a license?
 
-Licenses can be obtained at [https://www.wordfence.com/products/wordfence-cli/](https://www.wordfence.com/products/wordfence-cli/).
+Licenses for Wordfence CLI are no longer available. Existing Premium licenses are valid until the end of their active license term and will not be renewed. Existing Free licenses will cease to be valid on October 14th, 2026.
 
 #### The scanner has identified malware.  What do I do now?
 

wordfence/api/noc1.py

@@ -76,10 +76,11 @@ def _check_error_message(self, response: dict) -> None:
     def validate_response(self, response, validator: Validator) -> None:
         if isinstance(response, dict):
             self._check_error_message(response)
-            paid = bool('_isPaidKey' in response and response['_isPaidKey'])
-            if paid != self.license.paid:
-                self.license.paid = paid
-                self._trigger_license_update_hooks(self.license)
+            if '_isPaidKey' in response:
+                paid = bool(response['_isPaidKey'])
+                if paid != self.license.paid:
+                    self.license.paid = paid
+                    self._trigger_license_update_hooks(self.license)
             terms_updated = '_termsUpdated' in response
             self._trigger_terms_update_hooks(terms_updated, self.license)
         return super().validate_response(response, validator)
@@ -192,17 +193,6 @@ def get_precompiled_malware_signatures(
     def ping_api_key(self) -> bool:
         return self.process_simple_request('ping_api_key')
 
-    def get_cli_api_key(self, accept_terms: bool = False) -> str:
-        response = self.request(
-                'get_cli_api_key',
-                {'accept_terms': int(accept_terms)}
-            )
-        validator = DictionaryValidator({
-                'apiKey': str
-            })
-        self.validate_response(response, validator)
-        return response['apiKey']
-
     def record_toupp(self) -> bool:
         success = self.process_simple_request('record_toupp')
         if success:

wordfence/cli/cli.py

@@ -154,7 +154,6 @@ def invoke(self) -> int:
                     context,
                     self.helper,
                     license_manager,
-                    terms_manager,
                     self.subcommand_definitions,
                     self.subcommand_definition
                 )
@@ -168,8 +167,16 @@ def invoke(self) -> int:
             if self.subcommand_definition.requires_config:
                 if not configurer.check_config():
                     return 0
-                if not self.subcommand_definition.uses_license:
-                    license_manager.check_license()
+                license = context.get_license()
+                if license is not None and not license.paid:
+                    log.warning(
+                        "The Free version of Wordfence CLI will reach "
+                        "end-of-life on October 14th, 2026. Existing free "
+                        "license holders may continue to use Wordfence CLI "
+                        "until that time. New free license keys may no longer "
+                        "be generated."
+                    )
+
                 terms_manager.prompt_acceptance_if_needed()
 
             subcommand = self.subcommand_definition.initialize_subcommand(

wordfence/cli/configure/configure.py

@@ -7,7 +7,6 @@ class ConfigureSubcommand(Subcommand):
     def invoke(self) -> int:
         configurer = self.context.configurer
         configurer.overwrite = self.config.overwrite
-        configurer.request_license = self.config.request_license
         if self.config.workers is not None \
                 and self.config.workers < MIN_WORKERS:
             if self.config.is_from_cli('workers'):

wordfence/cli/configure/definition.py

@@ -10,14 +10,6 @@
         "argument_type": "OPTIONAL_FLAG",
         "default": None
     },
-    "request-license": {
-        "short_name": "r",
-        "description": "Automatically request a free license without "
-                       "prompting",
-        "context": "CLI",
-        "argument_type": "OPTIONAL_FLAG",
-        "default": None
-    },
     "workers": {
         "short_name": "w",
         "description": "Specify the number of worker processes to "
@@ -32,9 +24,7 @@
     "default": {
         "short_name": "D",
         "description": "Automatically accept the default values for any "
-                       "options that are not explicitly specified. This will "
-                       "also result in a free license being requested when "
-                       "terms are accepted.",
+                       "options that are not explicitly specified",
         "context": "CLI",
         "argument_type": "FLAG",
         "default": False
@@ -51,8 +41,9 @@
     UsageExample(
         'Non-interactively configure Wordfence CLI to use 4 worker processes '
         'and the default values for all other options, automatically '
-        'accepting the terms and requesting a free license',
-        'wordfence configure --default --workers 4 --accept-terms'
+        'accepting the terms and using an existing license',
+        'wordfence configure --default --workers 4 --accept-terms '
+        '--license {license}'
     )
 ]
 

wordfence/cli/configurer.py

@@ -9,13 +9,12 @@
         InvalidInputException, InputException
 from wordfence.util.io import ensure_directory_is_writable, \
         ensure_file_is_writable, resolve_path, IoException
-from wordfence.api.licensing import License, LICENSE_URL
+from wordfence.api.licensing import License
 from wordfence.logging import log
 from .config import load_config
 from .context import CliContext
 from .subcommands import SubcommandDefinition
 from .licensing import LicenseManager, LicenseValidationFailure
-from .terms_management import TERMS_URL, TermsManager
 from .helper import Helper
 from .mailing_lists import EMAIL_SIGNUP_MESSAGE
 
@@ -137,7 +136,6 @@ def __init__(
                 context: CliContext,
                 helper: Helper,
                 license_manager: LicenseManager,
-                terms_manager: TermsManager,
                 subcommand_definitions: Dict[str, SubcommandDefinition],
                 subcommand_definition: Optional[SubcommandDefinition] = None
             ):
@@ -148,11 +146,9 @@ def __init__(
         self.all_config[context.config.subcommand] = context.config
         self.config_values = []
         self.license_manager = license_manager
-        self.terms_manager = terms_manager
         self.subcommand_definition = subcommand_definition
         self.subcommand_definitions = subcommand_definitions
         self.overwrite = None
-        self.request_license = None
         self.workers = None
         self.default = False
         self.written = False
@@ -209,9 +205,7 @@ def _prompt_for_license(self) -> License:
 
         if self.config.license is not None:
             print(f'Current license: {self.config.license}')
-            change_license = self.request_license \
-                or self.default \
-                or prompt_yes_no(
+            change_license = False if self.default else prompt_yes_no(
                     'An existing license was found, '
                     'would you like to change it?',
                     default=False
@@ -228,43 +222,6 @@ def _prompt_for_license(self) -> License:
                             'a valid license.'
                         )
 
-        request_free = self.default or self.request_license or prompt_yes_no(
-                'Would you like to automatically request a free Wordfence CLI'
-                ' license?',
-                default=True
-            )
-        if not request_free:
-            print(f'Please visit {LICENSE_URL} to obtain a license key.')
-
-        if request_free:
-            terms_accepted = self.config.accept_terms or prompt_yes_no(
-                    'Your access to and use of Wordfence CLI Free edition is '
-                    'subject to the Wordfence CLI License Terms and '
-                    f'Conditions set forth at {TERMS_URL}. By entering "y" '
-                    'and selecting Enter, you agree that you have read and '
-                    'accept the Wordfence CLI License Terms and Conditions.',
-                    default=False
-                )
-            if terms_accepted:
-                license = self.license_manager.request_free_license(
-                        terms_accepted
-                    )
-                self.terms_manager.record_acceptance(
-                        license=license,
-                        remote=False
-                    )
-                print(
-                        'Free Wordfence CLI license obtained successfully: '
-                        f'{license}'
-                    )
-                return license
-            else:
-                print(
-                        'A license cannot be obtained automatically without'
-                        ' agreeing to the Wordfence CLI License Terms and '
-                        'Conditions.'
-                    )
-
         license = prompt(
                 'License',
                 self.config.license,

wordfence/cli/licensing.py

@@ -30,10 +30,6 @@ def _create_noc1_client(
             ) -> noc1.Client:
         return self.context.create_noc1_client(license)
 
-    def request_free_license(self, terms_accepted: bool = False) -> License:
-        client = self.context.create_noc1_client()
-        return License(client.get_cli_api_key(accept_terms=terms_accepted))
-
     def validate_license(self, license: Union[License, str]) -> License:
         license = to_license(license)
         client = self.context.create_noc1_client(license)

wordfence/php/lexing.py

@@ -1,6 +1,5 @@
 import re
 
-from collections import deque
 from enum import Enum, auto
 from typing import Generator, BinaryIO, Optional, Union, Set
 
@@ -422,9 +421,10 @@ def __str__(self) -> str:
 class Lexer:
 
     def __init__(self, stream: BinaryIO, chunk_size: int = 4096):
-        self.chunks = deque()
+        self.chunks = []
         self.chunk_size = chunk_size
         self.chunk_offset = 0
+        self.current_chunk_index = 0
         self.read = 0
         self.stream = stream
         self.offset = 0
@@ -445,6 +445,7 @@ def step(self) -> bool:
         if self.position > self.read:
             if not self._read_chunk():
                 return False
+        self._update_current_byte()
         return True
 
     def get_current(self) -> bytes:
@@ -464,11 +465,32 @@ def get_current(self) -> bytes:
             remaining -= chunk_length
         return b''.join(components)
 
+    def get_current_byte(self) -> bytes:
+        """Return the byte at the current position without rebuilding input."""
+        if self.position == 0 or not self.chunks:
+            return b''
+        chunk = self.chunks[self.current_chunk_index]
+        offset = self.position - self.chunk_offset - 1
+        return chunk[offset:offset + 1]
+
+    def _update_current_byte(self) -> None:
+        while self.current_chunk_index < len(self.chunks) - 1 and \
+                self.position > self.chunk_offset + \
+                len(self.chunks[self.current_chunk_index]):
+            self.chunk_offset += len(self.chunks[self.current_chunk_index])
+            self.current_chunk_index += 1
+        while self.current_chunk_index > 0 and \
+                self.position <= self.chunk_offset:
+            self.current_chunk_index -= 1
+            self.chunk_offset -= len(self.chunks[self.current_chunk_index])
+
     def step_backwards(self) -> None:
         self.position -= 1
+        self._update_current_byte()
 
     def reset(self) -> None:
         self.position = self.offset
+        self._update_current_byte()
 
     def consume_token(self, token_type: TokenType) -> Token:
         value = self.get_current()
@@ -514,9 +536,11 @@ def extract_php_token(self, types=TokenType) -> Optional[Token]:
 
     def extract_inline_html_or_open_tag(self) -> Optional[Token]:
         partial_start = None
+        tag_length = len(b'<?php')
+        tag_suffix = b''
         while self.step():
-            current = self.get_current()
-            match_type = TokenType.OPEN_TAG.match_at_end(current)
+            tag_suffix = (tag_suffix + self.get_current_byte())[-tag_length:]
+            match_type = TokenType.OPEN_TAG.match(tag_suffix)
             if match_type == MatchType.PARTIAL_MATCH and partial_start is None:
                 partial_start = self.position
             elif match_type == MatchType.FINAL_MATCH:

wordfence/php/parsing.py

@@ -1621,13 +1621,14 @@ def parse_any(
                 token_stream: TokenStream,
                 in_php_tag: bool = False
             ) -> (bool, Optional[PhpInstruction]):
-        try:
-            if in_php_tag:
-                return (True, self.parse_statement(token_stream))
-            else:
-                return (False, self.parse_output(token_stream))
-        except TagStateChanged as change:
-            return self.parse_any(token_stream, change.state)
+        while True:
+            try:
+                if in_php_tag:
+                    return (True, self.parse_statement(token_stream))
+                else:
+                    return (False, self.parse_output(token_stream))
+            except TagStateChanged as change:
+                in_php_tag = change.state
 
     def parse(self, context: PhpContext = None) -> PhpContext:
         if context is None:

wordfence/scanning/scanner.py

@@ -193,9 +193,18 @@ def __init__(
         self.allow_io_errors = allow_io_errors
         self.scanned_paths = scanned_paths if scanned_paths is not None \
             else PathSet()
+        self.root_path = None
         self.located_count = 0
         self.skipped_count = 0
 
+    def _is_within_root(self, path: bytes) -> bool:
+        """Return whether a resolved path is contained by the scan root."""
+        try:
+            return os.path.commonpath((self.root_path, path)) == self.root_path
+        except ValueError:
+            # Paths on different drives cannot be contained by one another.
+            return False
+
     def _is_loop(
                 self,
                 path: bytes,
@@ -232,6 +241,12 @@ def search_directory(self, path: bytes, parents: Optional[list] = None):
             try:
                 if item.is_symlink():
                     item_path = os.path.realpath(item.path)
+                    if not self._is_within_root(item_path):
+                        log.warning(
+                                'Skipping symlink outside scan root: '
+                                + os.fsdecode(item.path)
+                            )
+                        continue
                     if item_path in self.scanned_paths:
                         continue
                     # This intentionally uses the unresolved path
@@ -264,6 +279,7 @@ def _push_file(self, path: bytes) -> None:
 
     def locate(self):
         real_path = os.path.realpath(self.path)
+        self.root_path = real_path
         if os.path.isdir(real_path):
             for path in self.search_directory(real_path):
                 self._push_file(path)