WPScan

Vulnerability Analysis

Intermediatemedium risk

WPScan is a black box WordPress vulnerability scanner that enumerates active plugins, themes, user accounts, and security vulnerabilities linked to a specific WordPress installation.

Installation

sudo apt install wpscan

Basic Syntax

wpscan --url <target_wordpress_url>

Quick Facts

Full Name

WPScan WordPress Scanner

License

AGPL

Language

Ruby

Vulnerability DB

WPVulnDB

Category

CMS Scanner

Target

WordPress Only

Tool Overview

WPScan is a black box WordPress vulnerability scanner that enumerates active plugins, themes, user accounts, and security vulnerabilities. It is the most widely used WordPress security assessment tool.

The tool checks for known vulnerabilities in WordPress core, plugins, and themes by comparing detected versions against the WPVulnDB vulnerability database. It also supports user enumeration and password brute forcing.

WPScan is essential for WordPress security assessments, providing detailed information about installed components and their security status. It requires an API token for full vulnerability database access.

Common Commands

wpscan --url http://example.comBasic scan - Check basic components and structural versions

wpscan --url http://example.com --enumerate vp,vt,uDeep enumeration - Enumerate vulnerable plugins, vulnerable themes, and usernames

wpscan --url http://example.com --api-token YOUR_TOKENVulnerability DB check - Pull known exploitation CVEs utilizing a WPScan API token

wpscan --url http://192.168.1.1/wordpressBasic scan - Check WordPress for vulnerabilities

wpscan --url http://192.168.1.1 --enumerate uEnumerate users - Find WordPress usernames

wpscan --url http://192.168.1.1 --enumerate pEnumerate plugins - List installed plugins

wpscan --url http://192.168.1.1 -U users.txt -P passwords.txtPassword attack - Brute force WordPress logins

wpscan --url http://192.168.1.1 --api-token YOUR_TOKENVulnerability DB - Check against WPScan database

wpscan --url https://example.comBasic WordPress scan

wpscan --url https://example.com -e vpEnumerate vulnerable plugins

wpscan --url https://example.com -e vtEnumerate vulnerable themes

wpscan --url https://example.com -e uEnumerate usernames

wpscan --url https://example.com -e apEnumerate all plugins

wpscan --url https://example.com --detection-mode aggressiveAggressive detection

wpscan --url https://example.com --api-token TOKENWPVulnDB API integration

Step-by-Step Guide

1Verify the site is actually running WordPress by looking for common directories like wp-admin
2Execute the initial sweep: wpscan --url <target>
3Force user enumeration: wpscan --url <target> -e u
4List installed plugins: wpscan --url <target> -e p
5Compare the enumerated components against public exploit lists
6Supply your WPVulnDB API key to get automatic vulnerability matching
7Log your discoveries, highlighting outdated and vulnerable components

Warnings

Scanning WordPress sites without authorization may violate computer access laws
Brute force attacks against WordPress logins can trigger account lockouts and IP bans
Only scan WordPress installations you own or have explicit written permission to test
Enumeration activities may be logged by WordPress security plugins
Use WPScan findings to improve WordPress security rather than for unauthorized access

Use Cases

WordPress Auditing

Scan WordPress installations for known vulnerabilities.

Plugin Enumeration

Discover installed plugins and their versions.

User Discovery

Enumerate WordPress user accounts.

Brute Force

Test WordPress login credentials against wordlists.

Key Features

Plugin Detection: Enumerate installed plugins and versions.
Theme Detection: Discover WordPress themes in use.
User Enumeration: Find valid WordPress usernames.
Vulnerability DB: Match findings against WPVulnDB.
Brute Force: Test credentials with custom wordlists.

Related Tools

Nikto

Vulnerability Analysis

General web server scanner.

Hydra

Password Attacks

Network login brute forcer.

Frequently Asked Questions

What is WPScan used for?

WPScan is used for scanning WordPress installations for vulnerabilities, enumerating plugins and themes, discovering users, and testing passwords. It is the most popular WordPress security scanner.

Do I need a WPVulnDB API token?

An API token is not required for basic scanning, but it provides access to the full vulnerability database. Without it, WPScan can only detect plugins/themes, not match them to known CVEs.

Can WPScan brute force WordPress logins?

Yes, WPScan can brute force WordPress login pages using wordlists. Use -U for usernames and -P for password lists.

How does WPScan enumerate plugins?

WPScan checks for plugin files in the /wp-content/plugins/ directory and compares detected versions against the WPVulnDB for known vulnerabilities.

How do I install WPScan?

Install WPScan using: sudo apt install wpscan on Kali Linux. On other systems, install via Ruby: gem install wpscan, or use Docker: docker run wpscanteam/wpscan.

How do I use WPScan for a basic scan?

Run wpscan --url http://example.com to perform a basic WordPress scan. Add --api-token YOUR_TOKEN for vulnerability database matching.

What are the most common WPScan commands?

Common commands include: wpscan --url target (basic scan), wpscan --url target --enumerate vp,vt,u (all enumeration), wpscan --url target -U users.txt -P passwords.txt (brute force).

How do I enumerate WordPress users with WPScan?

Use wpscan --url target --enumerate u to enumerate WordPress user accounts. This discovers valid usernames that can be used for further attacks.

How do I get a WPVulnDB API token?

Register for a free account at wpscan.com/api. Free tokens allow 25 requests per day; paid plans offer more. Use the token with --api-token flag.

Is WPScan legal to use?

WPScan itself is legal software. However, scanning WordPress sites without permission from the owner may violate laws. Always obtain written authorization before testing.

How does WPScan compare to Nikto?

WPScan is WordPress-specific with plugin/theme matching and brute force. Nikto is a general web scanner with 6700+ tests. Use WPScan for WordPress; Nikto for general web scanning.

How does WPScan detect vulnerable themes?

WPScan checks /wp-content/themes/ and compares detected theme versions against the WPVulnDB for known vulnerabilities and CVEs.

What is the --enumerate flag in WPScan?

The --enumerate flag specifies what to enumerate: u (users), p (plugins), vp (vulnerable plugins), vt (vulnerable themes), tt (timthumbs), and more.

Why is WPScan not detecting plugins?

WPScan may miss plugins that are not in the default wordlist or have non-standard directory names. Use --enumerate p to force plugin enumeration.

How do I save WPScan results?

Use --output-format json --output results.json to save results in JSON format. WPScan also supports text and CLI output formats.

What is WPScan's rate limiting?

Use --rate-limit to control scan speed and avoid triggering WAFs: wpscan --url target --rate-limit 100 sets 100 requests per second.

How long does a WPScan scan take?

A basic scan takes 1-3 minutes. Enumeration with API token checks takes 5-10 minutes depending on the number of plugins/themes and network speed.

Can WPScan scan multiple WordPress sites?

WPScan scans one site at a time. For multiple sites, create a bash script to iterate through a list of URLs.

What is WPScan's --stealthy flag?

The --stealthy flag reduces scan aggressiveness to avoid detection by security plugins and WAFs. Use it for stealthier WordPress assessments.

Output Explanation

WPScan output displays WordPress enumeration results including installed plugins, themes, user accounts, and known vulnerabilities. The WPVulnDB integration provides CVE numbers and severity ratings for discovered issues. Version information highlights outdated components requiring updates.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.