Changelog

MMCRA Toolkit (free)

The free tier now covers the full set of CRA artifacts a WordPress product author needs.

Compliance Checklist — article-mapped, five-category checklist with live status from the toolkit’s own signals. Auto items resolve themselves; manual items are yours to confirm. Drives the Compliance Score.
security.txt — served dynamically at /.well-known/security.txt (RFC 9116) from your disclosure contact, with expiry and optional acknowledgments, policy, and canonical URLs.
Compliance Documents — Incident Response Plan and Cybersecurity Risk Assessment generators, pre-filled with CRA-aligned boilerplate and exportable to standalone HTML.
New Compliance Checklist, Compliance Documents, and security.txt pages in the in-page sidebar nav.
No new external calls — security.txt is served from your own site.

CycloneDX 1.6 SBOM generator for installed plugins — scans composer.lock, package-lock.json, and plugin headers.
Vulnerability Disclosure Policy editor (ISO/IEC 29147 conventions) — publish as a WordPress page or export as HTML, with the [mmcra_vdp] shortcode and a rate-limited, honeypot-protected submission form.
Disclosure Submissions admin — browse, triage, and bulk-action reports received via the shortcode.
EU Declaration of Conformity template per CRA Annex V — export to HTML, print to PDF for the signed copy.
Compliance Score — a 0–100 quantified posture with a transparent, click-to-fix deduction breakdown and CRA article references.
Audit log recording the SHA-256 of every artifact at write time.
5-step setup wizard with plain-English CRA explanations.
Single “CRA Toolkit” menu with an in-page sidebar nav. Translation-ready (.pot template included).

Pro extends the free plugin and requires MMCRA Toolkit (free) installed and active. All tiers cover unlimited sites.

Multi-plugin support — license cap enforces 1 (Solo), 5 (Studio), or unlimited plugins.
OSV.dev vulnerability check plus a weekly monitoring cron with email alerts on new advisories (CRA Article 14).
Plugin Scanner — static analysis of REST routes, AJAX handlers, capability checks, custom tables, outbound HTTP, and risk patterns, with HTML and JSON reports.
Compliance Bundle export — SBOM, VDP, DoC, scanner report, and audit CSV in one ZIP for the CRA Article 31 regulator handoff.
SBOM generation from an uploaded zip.
DoC HTML export beyond the free one-plugin allowance, and audit log CSV export.
License watermarking — a 16-character sha256(license_key + site_domain) fingerprint embedded in generated artifacts.
Ed25519-signed automatic updates, verified against a bundled public key before install.
AI-assisted advisory triage, scanner remediation, and Declaration-of-Conformity drafting (Claude).