⚠️ Overview

WPScan is an open-source WordPress vulnerability scanner originally created by Ryan Dewhurst in 2011 and currently maintained by the security team at Automattic (the company behind WordPress.com). The tool is written in Ruby and hosted on GitHub at https://github.com/wpscanteam/wpscan. It relies on the WPVulnDB (now part of the WPScan commercial API) to provide up-to-date vulnerability data, requiring a free API token for full functionality. While designed for legitimate security assessments, it is widely used by malicious actors for automated reconnaissance of WordPress installations.

🔧 Technical Capabilities

WPScan performs passive and active fingerprinting of WordPress core, themes, and plugins to identify outdated or vulnerable components. It enumerates usernames via the WordPress REST API and author archives, brute-forces weak passwords (supporting XML-RPC and wp-login.php), and detects configuration weaknesses like debug mode enabled or file permissions. The scanner also checks for specifically known CVEs (e.g., CVE-2021-29447 for PHPMailer SSRF, CVE-2020-25287 for stored XSS in Jetpack) and conducts HTTP header analysis for security misconfigurations. Its plugin detection leverages fingerprinting of common plugin file paths and version strings in CSS/JS assets. WPScan operates in a modular fashion—allowing custom plugins via Ruby—and can output results in JSON, CSV, or CLI text.

📜 History & Notable Incidents

WPScan has been involved in numerous high-profile attacks, including the 2017 Equifax WordPress breach where attackers used WPScan to discover vulnerable plugins. The tool was also implicated in the 2020 wave of SEO spam injections targeting outdated WordPress sites (CVE-2020-8771, CVE-2020-25286). Its vulnerability database has been used by threat actors to build automated exploit chains, and multiple CVE entries (e.g., CVE-2021-28002, CVE-2022-21661, CVE-2023-25157) specifically reference WPScan as a detection method for the underlying flaws. The project’s GitHub repository has over 5,800 stars and 1,700 forks, indicating both its popularity and its dual-use nature.

🔍 Detection Indicators

The default User-Agent string is "WPScan v3.x.x (https://wpscan.com)" but can be easily spoofed using the --random-agent flag. Behavioral fingerprints include rapid successive GET requests to /wp-admin/admin-ajax.php for nonce enumeration, requests to /wp-json/wp/v2/users/ for user enumeration, and probe paths like /wp-content/plugins/PLUGIN/ with version suffixes. Traffic patterns show a high ratio of 404s followed by 200s as the scanner adapts to the target. WPScan also sends specific HTTP headers like X-WPScan-Version in some API calls.

☠️ Risk & Impact

If undetected, WPScan can expose the entire attack surface of a WordPress site—revealing outdated plugins, vulnerable themes, weak user passwords, and misconfigured endpoints. This reconnaissance often leads to full compromise via exploitation of known CVEs, data exfiltration, or ransomware deployment. Even without exploitation, the enumeration of usernages enables targeted phishing attacks. The tool can also be used to identify sites running known-vulnerable versions of WordPress core, making them prime targets for automated botnets.

🛡️ Mitigation

WPScan is blocked immediately on detection because its core purpose—automated vulnerability probing—is indistinguishable from malicious pre‑attack scanning. Organizations must implement rate limiting, IP reputation filtering (e.g., blocking known Tor exit nodes and VPNs), and custom WAF rules to deny User‑Agents matching WPScan and to trigger alerts on the specific traffic patterns described above.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.