_ ReconLab
Commands  / Vulnerability Analysis  / WPScan

WPScan

WordPress vulnerability scanner.

KaliParrothigh

pkg: wpscan

WPScan enumerates WordPress core, plugins, themes and users and checks them against a vulnerability database.

Syntax

wpscan --url {url} [--enumerate ...]

Example

wpscan --url https://example.com --enumerate vp

Enumerates vulnerable plugins (vp) on the WordPress site.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

--url <https://target.tld>Target WordPress URL.
--enumerate <vp,u>What to enumerate: vp (vuln plugins), u (users), t (themes), ap (all plugins).
--api-token <TOKEN>WPScan API token (enables vulnerability data).
--passwords <rockyou.txt>Wordlist for password brute-force (with --usernames).
--usernames <admin>User(s) to brute-force.
--random-user-agentRandomise the User-Agent.
--no-bannerSuppress the banner.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

wpscan

Usage examples

wpscan --url https://target.tld --enumerate vp

Enumerate vulnerable plugins.

wpscan --url https://target.tld --enumerate u

Enumerate WordPress usernames.

wpscan --url https://t --usernames admin --passwords rockyou.txt

Brute-force the admin login.

Advantages
  • Best-in-class WordPress coverage
  • Plugin/theme/user enumeration
  • CVE database integration
Disadvantages
  • Noisy; user enum is intrusive
  • API token needed for full vuln data
  • WordPress-only
Tags
#wordpress#cms#web

Official docs: WPScan ↗

Related commands

CMSeeK

Detect CMS and enumerate version/plugins.

JoomScan

Joomla vulnerability/enumeration scanner.

Frequently asked questions

What is WPScan used for?
WPScan enumerates WordPress core, plugins, themes and users and checks them against a vulnerability database.
What is an example WPScan command?
A common example is: wpscan --url https://example.com --enumerate vp — Enumerates vulnerable plugins (vp) on the WordPress site.
Is WPScan part of Kali Linux?
Yes. WPScan ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install wpscan.
What category of security tool is WPScan?
WPScan is a Vulnerability Analysis tool with a high-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →