Skip to main content

​
Overview

The WordPress Scanner identifies vulnerabilities in WordPress installations, including the core platform, plugins, and themes. It uses WPScan technology to detect security issues specific to the WordPress ecosystem. The WordPress Scanner is a vulnerability scanner: it actively tests WordPress sites for security weaknesses. It does not add data to your Attack Surface. Identified vulnerabilities are reported as findings.

​
Supported targets

Provide the complete path to the WordPress installation. If WordPress is installed in a subdirectory (e.g., /blog/), include it in the URL.

​
Scan types

​
Parameters comparison

​
Tests comparison

Core tests Interesting findings Enumeration tests
The Deep scan performs aggressive detection and sends numerous requests to the server. It is more likely to be detected by IDS/IPS solutions. Only run it against systems you have authorization to test.

​
Custom scan

Full control over scan parameters:

​
Core tests

Core tests identify the WordPress version and main theme, then check for known vulnerabilities. These tests run in both Light and Deep scans.

​
Interesting findings

Interesting findings detect common WordPress misconfigurations and exposed files. See the tests comparison table for Light vs Deep availability.

​
Enumeration tests

Enumeration tests actively search for WordPress components and security issues. These tests are only available in Deep and Custom scans.
Plugin and theme vulnerabilities are the most common attack vector for WordPress sites. The Deep scan’s enumeration capabilities are essential for a thorough security assessment.

​
Authentication

The WordPress Scanner supports HTTP Basic Authentication in Custom scan mode for testing sites protected by server-level authentication. How to configure:
1

Select scan type

Choose Custom scan type.
2

Enable authentication

Enable Authentication in the scan settings.
3

Enter credentials

Enter your username and password.
Basic Authentication is different from WordPress login credentials. It’s typically configured at the server level (Apache/Nginx) to restrict access to the entire site or wp-admin area.
For detailed authentication configuration, see Authenticated scanning.

​
How it works

The WordPress Scanner uses WPScan technology and works in these steps:
  1. Version detection: Identifies WordPress core version from meta tags, scripts, and readme files
  2. Theme detection: Identifies the active theme and its version
  3. Interesting findings: Checks for misconfigurations and exposed files
  4. Enumeration: Discovers plugins, themes, users, and sensitive files (Deep/Custom only)
  5. Vulnerability matching: Cross-references detected versions against the WPScan vulnerability database
  6. Reporting: Generates findings with CVE details, CVSS scores, and remediation guidance
Vulnerability detection is version-based. The scanner identifies component versions and matches them against known vulnerabilities. Since vulnerabilities are discovered using version-based testing only, the risk level for findings will not exceed ‘high’ severity.

​
Follow-up actions

After identifying vulnerabilities:
  • Update WordPress core: Keep WordPress updated to the latest version
  • Update plugins and themes: Apply security patches for all components
  • Remove unused plugins: Delete plugins that are not actively used
  • Disable XML-RPC: If not needed, disable xmlrpc.php to prevent brute-force attacks
  • Hide version information: Remove readme.html and version meta tags
  • Scan the web application: Run Website Scanner for full web application testing
  • Schedule regular scans: Set up Scheduled scans for continuous monitoring