Wordfence plugin vulnerability check in small shell script

wordfence-plugin-check.sh

#!/bin/bash

wget -O wordfence-vulnerabilities.json "https://www.wordfence.com/api/intelligence/v2/vulnerabilities/production"

wp plugin list --skip-update-check --status=active --fields=name,version \
    | tail -n +2 \
    | while read -r PLUGIN VERSION; do
        UPDATE="$(jq -r --arg slug "${PLUGIN}" \
            '[.. | objects | select(."type"=="plugin" and ."slug"==$slug) | ."patched_versions"[]?] | if length>0 then map(split(".") | map(tonumber)) | max | join(".") else empty end' \
            wordfence-vulnerabilities.json
        )"
        EARLIER="$(printf '%s\n%s\n' "${VERSION}" "${UPDATE}" | sort -V | head -n 1)"
        if [ -z "${UPDATE}" ] || [ "${UPDATE}" == "${VERSION}" ] || [ "${EARLIER}" != "${VERSION}" ]; then
            continue
        fi
        echo "${PLUGIN} v${VERSION} has a vulnerability, update to v${UPDATE}"
        echo "wp plugin update ${PLUGIN}"
    done

echo "wp plugin list"

Needs WP-CLI, wget and jq