What is WPScan ??
🔍 What is WPScan?
WPScan is an open-source WordPress security scanner used to:
- Identify WordPress version
- Enumerate plugins, themes, users
- Detect known vulnerabilities (CVEs)
- Map issues to real exploits & fixes
👉 It is mainly used by:
- Penetration testers
- Bug bounty hunters
- Security auditors
- Blue teams (defensive assessments)
Why WPScan exists
WordPress powers ~40% of the internet.
Most attacks happen because of:
- Outdated plugins
- Vulnerable themes
- Weak configurations
WPScan automates recon + vulnerability mapping for WordPress.
🧠 How WPScan works (conceptually)
WPScan uses:
- Passive checks (safe, no noise)
- Active checks (requests that may be logged)
- Fingerprinting techniques
- WPScan vulnerability database
With an API key, it links findings to:
- CVE IDs
- Severity
- Fixed versions
- References
🧪 What WPScan can detect
1️⃣ WordPress Core
- WordPress version
- Known vulnerabilities
- Missing security headers
2️⃣ Plugins (BIGGEST ATTACK SURFACE)
- Installed plugins
- Plugin versions
- Vulnerabilities in plugins
- Exploit references
Example:
Plugin: contact-form-7
Vulnerability: Unauthenticated File Upload
3️⃣ Themes
- Active theme
- Outdated themes
- Vulnerabilities in themes
4️⃣ User Enumeration
Finds usernames via:
- REST API
- Author archives
- Login error messages
Why this matters:
- Enables brute-force
- Password spraying
- Credential stuffing
5️⃣ Configuration Issues
- XML-RPC enabled
- Directory listing
- Exposed debug info
- Weak permissions
⚙️ Common WPScan features
| Feature | Purpose |
|---|---|
| Passive scan | Safe, stealthy |
| Aggressive scan | Deeper, noisier |
| Enumeration | Plugins, themes, users |
| API integration | CVE details |
| Output formats | TXT, JSON |
| Random User-Agent | Bypass basic WAF |
| TLS bypass | Scan misconfigured HTTPS |
🧾 Example WPScan command
wpscan --url https://target.com -e ap,at,u
Explanation:
-e ap→ all plugins-e at→ all themes-e u→ users
🔑 WPScan API Key (VERY IMPORTANT)
Without API key:
- Limited vulnerability info
With API key:
- CVE IDs
- Severity
- Fixed versions
- References
This is what turns WPScan from scanner → pentest tool.
⚔️ WPScan in real pentesting
WPScan is used in the recon phase, not exploitation.
Typical flow:
- Identify WordPress
- Run WPScan
- Analyze vulnerable plugin/theme
- Search exploit (Exploit-DB, GitHub)
- Manual validation
- Report impact
⚠️ What WPScan is NOT
Important to tell students:
❌ Not an exploit tool
❌ Not a brute-force tool by default
❌ Not a “hack WordPress in one click” tool
It gives intel, not shells.
🔐 Legal & ethical usage
Only scan:
- Your own sites
- Labs
- Authorized targets
Unauthorized scanning = illegal.