21. Web Application Testing Tools
21.7 WPScan: Scanning WordPress
In short: WPScan checks the WordPress version, themes, plugins and users for known vulnerabilities.
A large share of the world's websites run WordPress, so it has its own scanner. WPScan checks the WordPress version, themes, plugins and users for known vulnerabilities.
wpscan --url http://192.168.56.30 # basic scan (a WordPress VM you set up)
wpscan --url http://192.168.56.30 --enumerate u # list usernames
wpscan --url http://192.168.56.30 --enumerate vp # vulnerable plugins
wpscan --url http://192.168.56.30 -U users.txt -P /usr/share/wordlists/rockyou.txt # password test (lab only)
WPScan uses a vulnerability database; a free API token from wpscan.com raises the daily limit. Most WordPress breaches come from outdated plugins, not WordPress core.
Ravindra Bagale's Tip
Don't just tell the client "your WordPress is old". Check the plugins – 90% of WordPress hacks happen through an old plugin. And if --enumerate u finds a username, tell the admin: don't show usernames publicly, and set a strong password + 2FA.
Ravindra Bagale's Tip – मराठी
Client ला "WordPress जुना आहे" एवढंच सांगू नका. Plugins बघा – 90% WordPress hacks जुन्या plugin मधून होतात. आणि --enumerate u ने username मिळाला तर admin ला सांगा: username public दिसू देऊ नका आणि strong password + 2FA लावा.
Ravindra Bagale's Tip – हिंदी
Client को सिर्फ़ "WordPress पुराना है" मत बताओ. Plugins देखो – 90% WordPress hacks पुराने plugin से होते हैं. और --enumerate u से username मिला तो admin को बताओ: username public मत दिखाओ और strong password + 2FA लगाओ.
Lab
(Optional, if you set up a WordPress VM.) Run wpscan --url <your wp lab> --enumerate u,vp and list the version, any vulnerable plugin and the usernames found. Write one hardening step for each finding.