WPScan
WPScan is a WordPress security scanner that identifies the core version, plugins and themes and matches them against a vulnerability database.
Legal & ethical use. Scan only WordPress sites you own or have permission to test. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Audit your own WordPress site for outdated plugins
- Practise on a local WordPress test install
Key features
- Enumerates plugins, themes and users
- Vulnerability database lookups via API token
- Password-guessing mode for authorised tests
Installation
Install via RubyGems (`gem install wpscan`) or from a distribution package.
Beginner usage guide
Scan a WordPress site you administer and compare the reported component versions with the latest releases.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Basic scan of a local WordPress test site
wpscan --url http://127.0.0.1:8082Reports the WordPress version and detectable issues; an API token adds vulnerability data.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary wpscan (____________________________________________________________...) on 2026-10-27.