⚠️ Overview

WPProbe is an open-source WordPress vulnerability scanner and enumeration tool, initially released by security researcher Michele '0xInfection' Fumagalli in 2019 and actively maintained on GitHub (github.com/0xInfection/WPProbe). Designed for offensive security assessments and bug bounty hunting, WPProbe is often abused by malicious actors to automate reconnaissance of WordPress installations, identifying plugins, themes, user accounts, and potential entry points without authorization.

🔧 Technical Capabilities

WPProbe performs deep, multi-threaded enumeration of WordPress sites by leveraging passive fingerprinting and active probing. It detects the core version, installed plugins (including their versions and active status), themes, user enumeration via author archives and REST API endpoints (e.g., /wp-json/wp/v2/users), and common misconfigurations like exposed wp-config.php backups or debug logs. The tool supports proxy chaining, custom User-Agent strings, and random delays to evade basic rate limiting. It also checks for known WordPress vulnerabilities—such as cross-site scripting (XSS), SQL injection, and file inclusion—by cross-referencing installed plugin versions against the WPScan Vulnerability Database. WPProbe can brute-force login credentials using dictionary attacks on the xmlrpc.php and wp-login.php endpoints, and it enumerates sensitive files like readme.html and license.txt to confirm version specifics. Additionally, it performs directory busting to discover hidden paths, such as /wp-content/uploads/ or /wp-admin/admin-ajax.php, and can extract timestamps from RSS feeds to estimate user creation dates.

📜 History & Notable Incidents

WPProbe first appeared on GitHub in August 2019 and quickly gained traction among red teams and bug bounty hunters. While not associated with a specific high‑profile breach, its usage has been documented in numerous penetration testing reports and CTF write‑ups. The tool’s effectiveness in user enumeration contributed to the WordPress core team hardening the REST API user endpoint in WordPress 4.7.1 (CVE-2017-5487) and later introducing options to disable author archives. WPProbe’s source code explicitly warns against illegal use, yet it remains a favorite for automated reconnaissance in malicious campaigns targeting high‑profile WordPress sites.

🔍 Detection Indicators

WPProbe typically sends requests with a default User‑Agent of “WPProbe/x.x” (e.g., “WPProbe/1.0.0”) or a generic Python‑requests agent. Behavioral fingerprints include rapid‑fire requests to /wp-json/wp/v2/users, /?author=N patterns, and simultaneous probing of multiple plugin/theme paths from a single IP. Traffic logs often show sequential GET requests to /wp-content/plugins/ and /themes/ directories with version permutations, accompanied by bursts of POST attempts to xmlrpc.php for login brute‑forcing.

☠️ Risk & Impact

If undetected, WPProbe can expose critical information: valid usernames (enabling targeted phishing and brute‑force attacks), outdated plugin/theme versions with known vulnerabilities, and backend file paths that facilitate further exploitation. Successful exploitation can lead to full site takeover, data exfiltration, or deployment of malware as a pivot point for broader network compromise. Even passive enumeration can fuel social‑engineering campaigns against site administrators.

🛡️ Mitigation

Because WPProbe aggressively fingerprints WordPress configurations and actively probes for weaknesses, it is blocked immediately upon detection to prevent information leakage and automated attacks. Mitigation includes rate limiting on API endpoints, disabling user enumeration via plugins, hiding the WordPress version, and using Web Application Firewall (WAF) rules that flag the tool’s known User‑Agent strings and request patterns.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.