ConfigsJul 21, 2026·3 min read

WPScan — WordPress Security Scanner for Vulnerability Detection

WPScan is an open-source black-box WordPress vulnerability scanner that detects security issues in WordPress core, plugins, and themes by checking against a comprehensive vulnerability database maintained by the WPScan team.

AI Open Source
AI Open Source · Community
Agent ready

Safe staging for this asset

This asset is staged first. The copied prompt tells the agent to inspect the staged files and ask before activating scripts, MCP config, or global config.

Stage only · 29/100Policy: stage
Agent surface
Any MCP/CLI agent
Kind
Skill
Install
Stage only
Trust
Trust: Established
Entrypoint
WPScan
Safe staging command
npx -y tokrepo@latest install f87b6599-849d-11f1-9bc6-00163e2b0d79 --target codex

Stages files first; activation requires review of the staged README and plan.

Introduction

WPScan identifies security vulnerabilities in WordPress installations by enumerating plugins, themes, and core versions, then cross-referencing them against a curated vulnerability database. Security professionals and site administrators use it to proactively find and fix weaknesses before attackers exploit them.

What WPScan Does

  • Scans WordPress sites to enumerate installed plugins, themes, and core version
  • Checks discovered components against the WPScan Vulnerability Database for known CVEs
  • Detects common misconfigurations like exposed wp-config backups and directory listings
  • Enumerates WordPress users via author archives, REST API, and login error messages
  • Performs password brute-force attacks against the WordPress login page

Architecture Overview

WPScan is written in Ruby and operates as a command-line tool. It sends HTTP requests to the target WordPress site, fingerprints the core version via meta tags and file hashes, and probes known plugin and theme paths to identify installed components. Each discovered component is matched against the WPScan Vulnerability Database API, which returns associated CVEs and severity scores. The scanner uses a modular detection engine with passive (response-based) and aggressive (file-probing) modes.

Self-Hosting & Configuration

  • Install via gem install wpscan or use the official Docker image wpscanteam/wpscan
  • Register for a free API token at wpscan.com for access to the vulnerability database
  • Configure scan aggressiveness with --detection-mode (passive, mixed, or aggressive)
  • Set custom user agents, proxy settings, and request throttling via command-line flags
  • Output results in JSON, CLI table, or integrate with CI pipelines for automated checks

Key Features

  • Comprehensive vulnerability database updated daily with WordPress-specific CVEs
  • Plugin and theme enumeration using both passive fingerprinting and brute-force probing
  • User enumeration through multiple discovery vectors
  • Configurable scan intensity from stealthy passive to thorough aggressive mode
  • JSON output for integration with security dashboards and CI/CD pipelines

Comparison with Similar Tools

  • Nuclei — general-purpose vulnerability scanner with templates; WPScan specializes exclusively in WordPress
  • Nikto — broad web server scanner; WPScan provides deeper WordPress-specific checks
  • Burp Suite — interactive web security testing platform; WPScan is a focused automated WordPress scanner
  • Sucuri SiteCheck — online scanner with limited depth; WPScan offers thorough local scanning with full control

FAQ

Q: Is WPScan free to use? A: The scanner is open source and free. The vulnerability database API offers free and paid tiers.

Q: Can I scan sites I do not own? A: Only scan sites you have explicit authorization to test. Unauthorized scanning may violate laws.

Q: How often is the vulnerability database updated? A: The WPScan team updates the database daily with new WordPress, plugin, and theme vulnerabilities.

Q: Does WPScan work against sites behind WAFs? A: It can, but WAF rules may block aggressive scans. Use passive mode and custom user agents to reduce detection.

Sources

Discussion

Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.

Related Assets

OWASP ZAP — Open-Source Web Application Security Scanner

The most widely used open-source web application security scanner for finding vulnerabilities during development and penetration testing.

Skills
AI Open Source

OWASP ZAP — Web Application Security Scanner

The world's most widely used open-source web application security scanner, providing automated and manual tools for finding vulnerabilities in web applications during development and testing.

Skills
AI Open Source

Gosec — Security Scanner for Go Source Code

A static analysis tool that inspects Go source code for security vulnerabilities by scanning the AST for patterns like SQL injection, hardcoded credentials, insecure crypto usage, and other common security issues.

Skills
Script Depot

Agentic Security — LLM/MCP Red-Team Scanner

Agentic Security is a Python tool to probe LLM apps with attack prompts and run scans; it also ships an MCP server entrypoint for tool-based workflows.

Skills
Agent Toolkit
◈Home🔍Search👤Me