wpcli-vulnerability-scanner - ARCHIVED: WP-CLI command for checking installed pl

项目说明

WP-CLI Scanner

> Check WordPress core, installed plugins and themes for .

 !WordPress tested up to ![MIT License]() ![Functional Tests]()

> [!CAUTION]
> As of 13 February 2026, this project is archived and no longer being actively maintained.

Installation

Global command, automatically

It can be installed as a wp-cli package via git repo which is the most preferred way to install.

API Access

WP-CLI Scanner works with WPScan, Patchstack and Wordfence Intelligence to check reported ; you can choose any one of these three to use. You will need to add a constant in your wp-config.php to decide which API service you want to use (by default WPScan API will be used).

To use WPScan API:

To use Patchstack API:

To use Wordfence Intelligence API:

*Note: Authentication is not required for the Wordfence Intelligence API ( ). is not required if using Wordfence as your provider.*

For WPScan and Patchstack you will need to register for a user account and supply an API token from the chosen API service. Once you ha the token, you can add it as a constant in wp-config.php as follows:

Global command, manually

Clone this repo, checkout to stable branch and require wpcli-.php from wp-cli config. E.g. in ~/.wp-cli/config.yml [other config locations]

Standard plugin

This repo can be installed as a regular plugin. There is no UI, but the command will become a.

After plugin installation, you can the command is in place with wp help vuln

Usage

* *Options:*
* --test Load test data
* --format=<format> Accepted : table, csv, json, count, ids, yaml. Default: table
* --nagios Output for nagios
* --reference includes the reference link of the within the output

* *Options:*
* --format=<format> Accepted : table, csv, json, count, ids, yaml. Default: table
* --nagios Output for nagios
* --reference includes the reference link of the within the output

* *Options:*
* --test Load test data
* --porcelain Only print slugs of plugins with updates
* --format=<format> Accepted : table, csv, json, count, ids, yaml. Default: table
* --nagios Output for nagios
* --reference includes the reference link of the within the output

* *Options:*
* --test Load test data
* --porcelain Only print slugs of theme with updates
* --format=<format> Accepted : table, csv, json, count, ids, yaml. Default: table
* --nagios Output for nagios
* --reference includes the reference link of the within the output

Example output

#### Checking WordPress core, plugins and themes for reported :

Using the JSON format:

#### Checking any gi:

Using the JSON format:

Example usage

Basic

Will simply error out if there are no slugs returned by the plugin-status command. Can suppress the output by appending &> /dev/null

Scheduled/Cron

0 0 * * * is e at midnight. For assistance creating an alternate schedule, check out For example, 0 0 * * 1,4 runs at midnight every Monday and Thursday.

With email notifications

Included is a sample bash script, includes/vuln.sh. This can be customized and used in a cron job so that you can be alerted when are found.

* WPCLIPATH should be the full path to your wp command. The script will attempt to discover this automatically if the gi does not exist

* RECIPIENT should be an email address which will receive the notifications
* SUBJECT is the email subject

This readme does not discuss configuring the mail command on your server. To run a simple test, try

Nagios

wp vuln plugin-status --nagios will gi for Nagios monitoring.

Check uninstalled themes and plugins

Check a specific of a theme or plugin. Example:

Or check several at once (cannot accept )

Running Tests

Prerequisites:

Must ha for and

To run tests against WPScan API:

To run tests against Patchstack API:

To run tests against Wordfence Intelligence API, is not required:

Install dependencies

*Note: Not uncommon for composer to run out of memory, you may need to take steps to free up memory on your end*

Run tests

PatchStack API

Wordfence API

Frequently Asked Questions

Where do I report security bugs found in this plugin?

Please report security bugs found in the source code of the undefined plugin through the Patchstack Disclosure  Program. The Patchstack team will assist you with , C, and notify the de of this plugin.

Support Level

Archived: This project is no longer maintained by 10up. We are no longer responding to Issues or Pull Requests unless they relate to security concerns. We encourage interested de to fork this project and make it their own!

Changelog

A complete listing of all notable changes to WP-CLI Scanner are documented in CHANGELOG.md.

Contributing

Please read CODE_OF_CONDUCT.md for details on our code of conduct, CONTRIBUTING.md for details on the process for submitting pull requests to us, and CREDITS.md for a listing of maintainers of, contributors to, and libraries used by WP-CLI Scanner.

Like what you see?

<a href=" src=" width="850" alt="Work with the 10up WordPress Practice at Fueled"></a>

项目信息

开发语言：PHP

Star 数：297

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕ARCHIVED: WP-CLI command for checking installed plugins and themes for vulnerabilities reported on wpvulndb.com展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。