wpscan
WordPress security vulnerability scanner
TLDR
SYNOPSIS
wpscan [--url url] [-e enumerate] [-U user] [-P passwords] [options]
DESCRIPTION
wpscan is a WordPress security scanner. It identifies vulnerabilities, misconfigurations, and weak credentials.User enumeration finds valid usernames through various techniques. These can be used for targeted attacks.Plugin and theme enumeration identifies installed components. Vulnerable plugins are a major attack vector for WordPress.The vulnerability database requires an API token. Free tokens have limited requests; paid tokens provide more.Password brute forcing tests credentials. Rate limiting may apply; use responsibly.Detection modes balance stealth versus thoroughness. Aggressive mode may trigger security plugins.
PARAMETERS
--url URL
Target URL.-e LIST
Enumeration options.-U USER
Username for brute force.-P FILE
Password wordlist.--api-token TOKEN
WPScan API token.-o FILE
Output file.-f FORMAT
Output format (cli, json, etc.).--random-user-agent
Random user agent.--wp-content-dir DIR
wp-content directory.--detection-mode MODE
Detection mode (mixed, passive, aggressive).--force
Don't check if target is WordPress.-v
Verbose mode.
ENUMERATION OPTIONS
u
Users.vp
Vulnerable plugins.ap
All plugins.vt
Vulnerable themes.at
All themes.cb
Config backups.dbe
DB exports.
INSTALL
CAVEATS
Only use with authorization. May trigger security alerts. API token needed for vulnerability data. Resource intensive for full scans.
HISTORY
WPScan was created by the WPScan Team around 2011. It became the standard WordPress security assessment tool, used by security professionals and bug bounty hunters.
