GO KALI FREE
BeginnerTools

WPScan Guide: WordPress Security Scanner

A comprehensive guide to WPScan for WordPress vulnerability detection, theme and plugin enumeration, user enumeration, and security assessment.

#wpscan#wordpress#cms scanning#vulnerability scanner#web security

Why You Need WPScan

You are auditing a WordPress site and need to find outdated versions, vulnerable plugins, or misconfigurations — WPScan specializes in WordPress security. It checks core versions, themes, plugins, user enumeration, and exposed sensitive files against a continuously updated vulnerability database.

Prerequisites

  • Basic understanding of WordPress architecture
  • API token for vulnerability database access
  • Explicit permission to test the target

    • How WPScan Works

    Version Detection: Identifies WordPress version through readme.html and generator tags.

    Theme/Plugin Enumeration: Detects installed components and checks for vulnerabilities.

    User Enumeration: Discovers registered usernames.

    Installation

    # Register at wpvulndb.com for API token
sudo apt install wpscan

    Basic Usage

    wpscan --url http://target.com --api-token YOUR_TOKEN

    Enumeration Options

    # Enumerate vulnerable plugins
wpscan --url http://target.com --enumerate vp

# Enumerate vulnerable themes
wpscan --url http://target.com --enumerate vt

# Enumerate users
wpscan --url http://target.com --enumerate u

# Enumerate config backups
wpscan --url http://target.com --enumerate cb

    Brute Forcing

    wpscan --url http://target.com --passwords /usr/share/wordlists/rockyou.txt
wpscan --url http://target.com --usernames admin --passwords passwords.txt

    Common Mistakes

    Running without API token. Ignoring false positives. Not checking version.

    Best Practices

    Always use API token. Use --random-user-agent. Scan in phases.

    Related Tools

  • **Nuclei**: Template-based scanner with WordPress templates
  • **Nikto**: Web server scanner with WordPress checks

    • Related Articles

  • [Nikto Guide](/articles/nikto-guide)
  • [Nuclei Guide](/articles/nuclei-guide)
  • [WhatWeb Guide](/articles/whatweb-guide)

    • Summary

    WPScan is the premier WordPress security scanner. Success requires an API token and appropriate enumeration options.

    Knowledge Check

  • Why need an API token?
  • Difference between passive and aggressive detection?
  • How to enumerate only vulnerable plugins?
  • How to brute-force passwords?
  • What does `--random-user-agent` do?

    • Frequently Asked Questions

    What is WPScan?

    WPScan is a free, open-source WordPress security scanner that detects outdated versions, vulnerable plugins and themes, weak passwords, and misconfigurations. It is pre-installed on Kali Linux.

    Do I need an API token for WPScan?

    Yes, a free API token from wpscan.com is required to check vulnerabilities against the WPScan Vulnerability Database. Without it, vulnerability detection is severely limited.

    How do you enumerate WordPress plugins?

    Use `wpscan --url http://target.com --enumerate vp` for vulnerable plugins or `-ep` for all plugins. WPScan probes plugin directories and reads readme files to identify installed components.

    How does WPScan enumerate users?

    Use `--enumerate u` to discover usernames through the WordPress REST API, author archives, and login page error messages. This reveals valid usernames for brute force attacks.

    How do you brute force WordPress logins with WPScan?

    Use `wpscan --url http://target.com --passwords wordlist.txt --usernames admin` to test passwords against discovered or specified usernames.

    How do you avoid being detected by WPScan?

    Use `--random-user-agent`, `--throttle 1000` to slow requests, and `--proxy` to route through Burp Suite. Running through a VPN adds an additional layer of anonymity.

    What does --enumerate cb do?

    The `--enumerate cb` flag searches for WordPress configuration backup files (wp-config.php~ and wp-config.php.bak) that may be exposed in the web root, potentially leaking database credentials.

    What common WordPress vulnerabilities does WPScan find?

    WPScan identifies outdated WordPress core versions, vulnerable themes/plugins with known CVEs, exposed wp-config.php backups, directory listing, XML-RPC enabled, and weak admin credentials.