Custom Plugin and Theme Security Updates

Custom plugins and themes used on CampusPress are client-owned and client-maintained.

CampusPress does not manage, maintain, or test custom plugin and theme functionality. Clients remain responsible for ongoing development, compatibility, and validation.

Security Exception

If a security vulnerability is identified in a custom plugin or theme that presents a material risk, CampusPress may take action to protect the platform and affected sites.

Our response is based on the severity and likelihood of exploitation, using trusted security intelligence.

How We Respond

High-risk vulnerabilities – RTTP: 0 days

These vulnerabilities are actively exploited, expected to become exploited, or receive a vPatching rule from Patchstack. To protect the platform and affected sites, CampusPress will apply the security update immediately to production without prior client approval. Clients are notified during or shortly after deployment.

Medium-risk vulnerabilities – RTTP: 7 days

These vulnerabilities could be exploited in targeted attacks, are not publicly known to be actively exploited, but receive a vPatching rule from Patchstack. CampusPress applies these updates for you in two stages:

  1. We apply the update immediately to your development network and notify you, so your team can review and test.
  2. Seven days later, we deploy the update to production and notify you again.

If your testing shows a problem, let us know before the production deployment so we can discuss next steps.

Low-risk vulnerabilities – RTTP: 30 days

These vulnerabilities are not expected to be exploited, are not known to be actively exploited, and do not require a vPatching rule from Patchstack.

Clients are notified for awareness and planning, and your team is responsible for applying the update by submitting a pull request to your Bitbucket repository, following the Developers workflow. We recommend testing on your development network before deploying to production.

Updates should be applied as part of regular maintenance and should not be indefinitely deferred.

Important Notes

  • Security updates are limited to resolving the identified vulnerability. Routine version, feature or compatibility updates remain the client’s responsibility and should be submitted via Bitbucket pull requests (see Developers). Receiving a vulnerability notice doesn’t mean CampusPress will handle future updates to that plugin.
  • Security updates do not transfer ownership or maintenance responsibility to CampusPress.
  • CampusPress does not perform functional or regression testing for custom plugins.
  • RTTP stands for Recommended Time to Patch

Clients are responsible for validating site behaviour after any update.