From 6f069d41fe4ff53813a0ec05a51f77fa2e646fc5 Mon Sep 17 00:00:00 2001
From: Felipe Zipitria <fzipi@fing.edu.uy>
Date: Sun, 13 Sep 2026 09:30:55 -0700
Subject: [PATCH 1/2] Add plugin.yaml descriptor

Adds the machine-readable plugin descriptor defined in
coreruleset/plugin-registry#37, per the rollout plan in
coreruleset/plugin-registry#21.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 plugin.yaml | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 plugin.yaml

diff --git a/plugin.yaml b/plugin.yaml
new file mode 100644
index 0000000..33af983
--- /dev/null
+++ b/plugin.yaml
@@ -0,0 +1,47 @@
+# OWASP CRS Plugin Descriptor
+# https://github.com/coreruleset/plugin-registry
+
+schema_version: 1
+
+plugin:
+  name: "wordpress-rule-exclusions-plugin"
+  description: "CRS rule exclusions for WordPress applications"
+  long_description: |
+    Provides targeted rule exclusions to eliminate false positives when
+    running OWASP CRS in front of vanilla WordPress sites (no WordPress
+    plugins installed). Covers the WordPress front end, the wp-admin
+    back end, and the REST API. Supports both block-based and classic
+    site editor themes; third-party theme plugins and builders are not
+    covered and must be tuned with custom rule exclusions.
+  type: "official"
+  category: "rule-exclusion"
+  status: "tested"
+  license: "Apache-2.0"
+  authors:
+    - name: "OWASP CRS Team"
+      url: "https://coreruleset.org"
+  repository: "https://github.com/coreruleset/wordpress-rule-exclusions-plugin"
+  keywords:
+    - "wordpress"
+    - "cms"
+    - "rule-exclusion"
+    - "false-positive"
+
+rule_id_range:
+  start: 9507000
+  end: 9507999
+
+compatibility:
+  crs_version: ">=4.0.0"
+  engines:
+    - "modsecurity2"
+    - "modsecurity3"
+    - "coraza"
+
+configuration:
+  file: "plugins/wordpress-rule-exclusions-config.conf"
+  variables:
+    - name: "tx.wordpress-rule-exclusions-plugin_enabled"
+      type: "boolean"
+      default: 1
+      description: "Enable or disable WordPress rule exclusions (0 to disable)"

From 5b1b0cfa1eea7357f9a626b274ac3c21fb5fa08f Mon Sep 17 00:00:00 2001
From: Felipe Zipitria <fzipi@fing.edu.uy>
Date: Sun, 13 Sep 2026 09:58:49 -0700
Subject: [PATCH 2/2] Drop redundant compatibility.engines list

The plugin is a plain SecRule/ctl-based rule exclusion with no
engine-specific dependency, so it works on every supported engine.
Per docs/plugin-descriptor-schema.md, omitting compatibility.engines
already means "all engines" - listing all three explicitly is
redundant and goes stale if a new engine is added to the schema enum.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 plugin.yaml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/plugin.yaml b/plugin.yaml
index 33af983..6e49698 100644
--- a/plugin.yaml
+++ b/plugin.yaml
@@ -33,10 +33,6 @@ rule_id_range:
 
 compatibility:
   crs_version: ">=4.0.0"
-  engines:
-    - "modsecurity2"
-    - "modsecurity3"
-    - "coraza"
 
 configuration:
   file: "plugins/wordpress-rule-exclusions-config.conf"