wpscan
Enumerates WordPress cores, plugins, themes, and users, and flags known vulnerable versions. (Not an OSI-approved license; free for non-commercial use.)
Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.
01Why WordPress gets its own tool
A large share of the web runs on WordPress, and most WordPress compromises come not from the core but from plugins and themes, of which a busy site may run dozens, each a separate codebase with its own vulnerabilities. wpscan knows this ecosystem: it fingerprints the core version, enumerates installed plugins and themes and their versions, lists users, and cross-references a vulnerability database to tell you which of them are known to be exploitable. It is the focused tool you run when the target is WordPress.
02Install and the API token
wpscan is a Ruby tool. To get the vulnerability data (which versions are actually vulnerable), register for a free API token on wpscan.com and pass it; without a token you still enumerate, but you do not get the vulnerability cross-reference that makes the output actionable.
$ sudo apt install wpscan # Debian / Kali
$ gem install wpscan # Gentoo / Fedora / any (RubyGems)
03Enumerating plugins, themes, and users
The --enumerate flag controls what wpscan looks for. vp is vulnerable plugins, vt vulnerable themes, u users. Enumerating all plugins (ap) is thorough but slow and noisy; vulnerable-only is the usual starting point.
$ wpscan --url https://target --enumerate vp,vt,u --api-token YOUR_TOKEN
04User enumeration and the login
Knowing the usernames (admin, editor above) is half of a credential attack; the other half is passwords. wpscan can run a password attack against the discovered users via the WordPress login or XML-RPC, with your wordlist. Do this only on your own site, and see the hydra guide for the general technique.
$ wpscan --url https://target --usernames admin --passwords /usr/share/wordlists/rockyou.txt
05Hardening your own WordPress
Run wpscan against your own WordPress and the report is a to-do list. Out-of-date plugins with known vulnerabilities are the single most common way WordPress sites fall; the scan names them and their fixes. User enumeration and a weak admin password are the other classic path.
» Update the core, plugins, and themes promptly; wpscan exists because people do not, and that is how sites get owned.
» Remove plugins and themes you do not use; every one is attack surface even when inactive.
» Enforce strong admin passwords and add two-factor; wpscan's user enumeration makes weak passwords the weak link.
» Limit login attempts and consider disabling XML-RPC if you do not need it, to blunt password attacks.
» Re-scan after updates to confirm the vulnerable versions are gone.
Authorized use only
The tools and techniques in these guides are for defending, testing, and understanding systems you own or have explicit written permission to assess. Unauthorized access to computers, networks, accounts, or data is a criminal offense in nearly every jurisdiction, and the penalties are real.
A few of the laws that apply, by way of example:
- Philippines: Cybercrime Prevention Act of 2012 (Republic Act No. 10175)
- United States: Computer Fraud and Abuse Act (18 U.S.C. § 1030)
- United Kingdom: Computer Misuse Act 1990
- European Union: Directive 2013/40/EU on attacks against information systems, as implemented by each member state
- Most other countries have equivalent computer-misuse laws
Wherever you are, the rule is the same: get authorization in writing, stay within the agreed scope, and never touch a system that is not yours to test. If you are unsure whether something is permitted, treat it as not permitted until you have clear authorization.
This is general information, not legal advice.