wpscan

WPScan is an open-source command-line security scanner designed for WordPress websites. It is written in Ruby and intended for security professionals, penetration testers, and blog maintainers who need to assess the security posture of their WordPress installations. Installation is supported across multiple platforms. On macOS, users can install via Homebrew with `brew install wpscanteam/tap/wpscan`. On Linux distributions, WPScan is available through package managers (such as Kali Linux's apt) or via RubyGems with `gem install wpscan`. Docker images are also available for containerized deployments. The tool requires Ruby 3.3 or later, Curl 7.72 or later, and RubyGems. Native extension dependencies like Nokogiri may require additional system packages. Core functionality includes version detection for WordPress core, theme detection, plugin enumeration, username enumeration, and backup folder discovery. The `--enumerate` flag supports various targets: `u` for usernames, `ap` for all plugins, `vp` for vulnerable plugins, `bf` for backup folders, and more. A `--stealthy` mode is available for lower-profile scanning. Plugin detection can be configured via `--plugins-detection` with options like passive or aggressive. WPScan integrates with the WPScan Vulnerability Database API to retrieve real-time vulnerability data. An API token is required, obtainable by registering at wpscan.com. Free accounts receive up to 25 API requests per day, which is sufficient for scanning most WordPress sites once daily. When the daily quota is exhausted, WPScan continues to function but without vulnerability data. Enterprise customers can alternatively use a local database dump via the `--enterprise-db-token` option, which downloads plugin, theme, and WordPress vulnerability data locally without API request limits. Configuration can be loaded from YAML or JSON files placed in XDG-compliant directories or legacy paths. Options include proxy settings, user agents, thread counts, custom headers, and API tokens. The API token can also be loaded from the `WPSCAN_API_TOKEN` environment variable. The local vulnerability database follows the XDG Base Directory Specification, stored at `~/.cache/wpscan/db` for new installations or `~/.wpscan/db` for legacy setups. Database updates are performed with `wpscan --update`, which only re-downloads files whose checksums have changed. Docker users can persist the database across runs by mounting a named volume at `/wpscan/.cache/wpscan/db`. WPScan is distributed under the WPScan Public Source License, which permits free use for non-commercial purposes including penetration testing, personal system testing, and inclusion in pentesting distributions. Commercial use requires a separate license. The tool is provided as-is without warranty or support.