WPScan — WordPress Security Scanner for Vulnerability Detection

Introduction

WPScan identifies security vulnerabilities in WordPress installations by enumerating plugins, themes, and core versions, then cross-referencing them against a curated vulnerability database. Security professionals and site administrators use it to proactively find and fix weaknesses before attackers exploit them.

What WPScan Does

• Scans WordPress sites to enumerate installed plugins, themes, and core version
• Checks discovered components against the WPScan Vulnerability Database for known CVEs
• Detects common misconfigurations like exposed wp-config backups and directory listings
• Enumerates WordPress users via author archives, REST API, and login error messages
• Performs password brute-force attacks against the WordPress login page

Architecture Overview

WPScan is written in Ruby and operates as a command-line tool. It sends HTTP requests to the target WordPress site, fingerprints the core version via meta tags and file hashes, and probes known plugin and theme paths to identify installed components. Each discovered component is matched against the WPScan Vulnerability Database API, which returns associated CVEs and severity scores. The scanner uses a modular detection engine with passive (response-based) and aggressive (file-probing) modes.

Self-Hosting & Configuration

• Install via gem install wpscan or use the official Docker image wpscanteam/wpscan
• Register for a free API token at wpscan.com for access to the vulnerability database
• Configure scan aggressiveness with --detection-mode (passive, mixed, or aggressive)
• Set custom user agents, proxy settings, and request throttling via command-line flags
• Output results in JSON, CLI table, or integrate with CI pipelines for automated checks

Key Features

• Comprehensive vulnerability database updated daily with WordPress-specific CVEs
• Plugin and theme enumeration using both passive fingerprinting and brute-force probing
• User enumeration through multiple discovery vectors
• Configurable scan intensity from stealthy passive to thorough aggressive mode
• JSON output for integration with security dashboards and CI/CD pipelines

Comparison with Similar Tools

• Nuclei — general-purpose vulnerability scanner with templates; WPScan specializes exclusively in WordPress
• Nikto — broad web server scanner; WPScan provides deeper WordPress-specific checks
• Burp Suite — interactive web security testing platform; WPScan is a focused automated WordPress scanner
• Sucuri SiteCheck — online scanner with limited depth; WPScan offers thorough local scanning with full control

FAQ

Q: Is WPScan free to use? A: The scanner is open source and free. The vulnerability database API offers free and paid tiers.

Q: Can I scan sites I do not own? A: Only scan sites you have explicit authorization to test. Unauthorized scanning may violate laws.

Q: How often is the vulnerability database updated? A: The WPScan team updates the database daily with new WordPress, plugin, and theme vulnerabilities.

Q: Does WPScan work against sites behind WAFs? A: It can, but WAF rules may block aggressive scans. Use passive mode and custom user agents to reduce detection.

Sources

• https://github.com/wpscanteam/wpscan
• https://wpscan.com