wpsecscan - Defensive WordPress security scanner — 189 checks,

项目说明

WPSecScan

![tests]()
![CVE feed]()
![release]()
![downloads]()
![python]()
![PyPI]()

> ⚠ AUTHORIZED USE ONLY
>
> WPSecScan is a defensi tool. Use it only on sites you own
> or sites whose owner has given you written permission to test.
> Unauthorised scanning is illegal in most jurisdictions (e.g. the US
> Computer Fraud and Abuse Act, the UK Computer Misuse Act 1990, the EU
> Network and Information Security Directive). The maintainers accept no
> liability for misuse. By using this software you confirm you have the
> required authorisation for every target you scan.

The most thoroughly-sourced WordPress scanner — open source, AGPLv3, runs locally.

226 checks across 18 categories. 8-source nightly C
(NVD + GHSA + Mitre + OS + WP + CIRCL +
Patchstack). SLSA L3 + Sigstore-signed releases. **10-provider
threat-intel federation** (CISA KEV, EPSS, Exploit-DB, Metasploit,
ATT&CK Na, STIX, MISP, OpenCTI, OTX, GreyNoise). **Continuous
monitoring (CT/DNS/WHOIS/RBL/honeypot/auto-rollback). Active
exploit with strict consent gating. Enterprise
mode**: OIDC + SAML + RBAC + audit-log + appro +
multi-tenant + quotas. Distribution: Docker, K8s, Homebrew, Snap,
Flatpak, winget, AUR, Chocolatey.

Original headline:
gives you a fresher and more complete database than
any single paid or free service. Runs entirely on your machine — no
telemetry, no per-site licensing, no data leaves your box.

Ships as two standalone Windows binaries — no Python required on the machine you run them on.

wpsecscan.exe — command-line scanner. Output: console + HTML + JSON + CS + Markdown + Excel (XLSX) + executive PDF + Burp scope XML + CycloneDX SBOM + shields.io status badge SVG.

wpsecscan-gui.exe — full GUI with li tree, finding details, risk score,

scan profiles, multi-target queue, scheduled scans, webhook alerts, exploit playbooks, and more.

wpsecscan-companion.zip — WordPress plugin that exposes a read-only, token-gated

REST endpoint so the scanner gets authoritati in one round-trip (3× more
accurate plugin/theme detection guessing).

Why people are switching to WPSecScan

8-source C runs nightly on our infrastructure — pulls

Wordfence + NVD + GitHub Security Ad + Mitre CVE List + OSV.dev +
WP.com + CIRCL + Patchstack and merges them into one feed.
Users get a strictly fresher + more complete DB than Wordfence/Patchstack
alone. 6 of 8 sources are fully free, no key required.

Daily DB refresh + per-C alerts — wpsecscan schedule


install registers a daily 02:00 C + weekly 03:00 site scan
on Windows Task Scheduler / macOS launchd / Linux systemd.
wpsecscan db subscribe fires the moment a
new C for a plugin you ha.

15 compliance frameworks mapped per check: OWASP Top 10 + MITRE

ATT&CK + CWE + D3FEND + PCI-DSS 4.0 + NIST 800-53 + ISO 27001 + HIPAA +
FERPA + SOC 2 + FedRAMP + GDPR + HITRUST CSF v11.4 + CMMC 2.0 +
NIST CSF 2.0 + CIS Critical Controls v8 + ISO 27001:2022 Annex A.

11 report formats: HTML, JSON, CS 2.1.0, Markdown, Excel

(XLSX with per-OWASP-category sheets), executive PDF, CycloneDX SBOM,
Burp Suite scope XML, attestation PDF, shields.io status-badge SVG.

10 third-party integrations including Burp Suite project XML,

OWASP ZAP findings import, Nuclei template auto-pull, JIRA / Linear /
GitHub Issues bulk-create, Wordfence Cloud sync, Sucuri SiteCheck,
Patchstack + WPScan write-back, WP Engine / Kinsta / WP.com host APIs.

AI-assisted remediation with PII masking + prompt-injection guard +

per-backend cost tracking. Bring your own OpenAI / Anthropic / Ollama /
llama.cpp key. WPSECSCAN_NO_AI=1 to hard-disable.

Pri: no telemetry, runs locally, supports SOCKS5/HTTP

proxies (Tor friendly), WPSECSCAN_NO_NETWORK=1 for air-gapped mode.

---

Quick install

Option A — pip install wpsecscan (any platform)

The simplest path on Linux, macOS, or Windows-with-Python:

PyPI: <

For the optional GUI minimize-to-tray feature, install with the
[ui] extra (pulls in Pillow + pystray):

Other optional extras: [pdf] (reportlab for true PDF exec reports),
[browser] (playwright for headless DOM-XSS), [yaml] (pyyaml for
daemon config), [ops] (redis + bcrypt for enterprise mode), or
[all] to install e.

Option B — pre-built Windows binaries

1. Open dist\ in this folder.
2. Copy wpsecscan.exe and wpsecscan-gui.exe somewhere on your PATH
(e.g. C:\Tools\ or C:\Users\<you>\bin\).
3. Done. No Python, no installer, no admin rights needed.

The first time you run them, Windows SmartScreen may warn that the publisher is unknown
(the binaries aren't code-signed). Click More info → Run anyway.

Option C — build from source

Requires Python 3.10+ and PyInstaller. Open PowerShell in the project root:

This creates a in .venv\, installs dependencies from requirements.txt,
and runs PyInstaller. Output:

Both are single-file executables — copy them anywhere and they run on their own.

Option D — run from source directly (de)

---

First scan

GUI

1. Double-click wpsecscan-gui.exe.
2. Paste a URL into the URL field (e.g. ).
3. Click Scan. Watch the live tree on the left and click any finding to read
e, remediation, and the *Exploit Playbook* (concrete sqlmap/Metasploit/curl/nuclei commands).
4. When the scan finishes, the Risk Score badge at the top shows 0-100 color-coded
(green/yellow/orange/red). HTML and JSON reports are saved to your user folder.

CLI

Exit codes: 0 = clean / info only · 1 = medium findings · 2 = critical or high findings · 130 = Ctrl+C.

v2.8.x subcommand families

---

What it checks (226 checks)

Passi always run; aggressi need --aggressive.

Recon: WP core · plugin enum (slug + ) · theme enum · user enum (?author=, REST wp/v2/users)

Surface: 40+ exposed-path probes (.env, wp-config.php.bak, .git/config, debug.log, backup-plugin dumps, phpinfo, adminer, …) · WebDA enum · beta/test/debug query-parameter discovery

Auth surface: wp-login.php + XML-RPC method enum + system.multicall amplifier check + rate-limit probe · OAuth2/OIDC discovery audit · SAML / XSW endpoint discovery · JWT audit (alg=none + weak HS256 brute-force)

Transport: TLS , cert expiry, HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, cookie flags

APIs: REST namespace map, REST OPTIONS write-method enum, WPGraphQL introspection, CORS misconfig (full preflight matrix incl. null origin reflection)

Defensi: WAF / CDN detection · WAF rule-set identification (CRS / AWS / Cloudflare Managed / Wordfence Premium) · DNS SPF / DMARC / DKIM · security.txt · AbuseIPDB reputation (opt-in)

Supply-chain: external JS hosts + SRI hash check · source-map exposure · JS library audit · S3 bucket discovery + public-ACL probe · GitHub leaked-token search (opt-in, scans your domain against AKIA/sk_live_/ghp_/etc.)

Subdomain attack surface: certificate-transparency discovery · dangling-CDN takeo · cookie-tossing chain detection (apex-cookie + takeo subdomain)

Ser: Ser, X-Request-ID, X-Debug-Token leaks

C: 7000+ Wordfence CVEs + 307 high-confidence exploit signatures + 224 modern payloads · CISA KE enrichment · EPSS percentile scoring · URL/IP enrichment (opt-in)

Aggressive (--aggressive): SQLi (error-based + time-blind escalator) · reflected XSS · SSRF · path tra · open redirect · file upload · default credentials (max 10) · SSTI (7 template engines) · NoSQL operator injection · path-normalisation bypass (..%2f, ..;/, …) · race-condition probe (parallel POSTs) · active HTTP smuggling (CL.TE / TE.CL) · headless DOM-XSS (Playwright, optional)

Deep (--deep-throttle): 10-500 wrong-password attempts at 5-60s pacing to map your login throttle threshold (synthetic non-existent user, fixed wrong password — ne)

Authenticated (--auth-user/--auth-pass): logs in, audits user roles, plugins, Site Health, options

Round-54 additions (Nov 2026 — A1-G4 catalogue)

WPSecScan grew from 80 → 94 checks plus a wide non-check toolkit:

| Area | New |
|------|-----|
| Acti | ssti, nosql_injection, path_bypass, race_condition, dom_xss_headless (Playwright optional) |
| Passive / intel checks | webdav, de, abuseipdb_lookup (--abuseipdb-token), waf_ruleset, oauth_oidc, saml_xsw, s3_bucket_discovery, github_leak_search (--github-search-token), jwt_audit |
| Modified checks | subdomains (B7 cookie-tossing chain), cors (B8 preflight matrix incl. Origin: null), sqli (A3 time-blind escalator), smuggling_probe (A6 active CL.TE/TE.CL) |
| Threat-intel integrations | CISA KEV, EPSS, , Sucuri SiteCheck, N C |
| Per-check tags | new cwe (e.g. CWE-79) + d3fend (e.g. D3-IVA) fields in data/check_tags.json |
| Reporters | one-page executive PDF (--exec-pdf, uses reportlab or HTML fallback) · two-report drag-and-drop HTML diff · Burp Suite scope XML (--burp-export) · se × OWASP-category S embedded in HTML report |
| CLI flags | --fail-on, --diff-against, --shell, --replay-har, --daemon, --abuseipdb-token, --, --github-search-token, --burp-export, --exec-pdf |
| GUI windows | step-by-step exploit-playbook walker (right-click any finding) · drill historical findings by OWASP/ATT&CK/CWE/D3FEND tag · multi-URL risk-score trend o · drop-in marketplace browser · 5-step first-run tutorial |
| Collab | assign-owner + comment threads per finding (right-click) |
| Infra / docs | .github/workflows/wpsecscan.yml (nightly + PR scans) · GitLab CI / Jenkins / Azure DevOps templates in ci/ · Dockerfile + docker-compose.yml · SDK.md · DISTRIBUTED-SCAN.md · audit-log JSONL of every scan in · custom signature / payload drop-in (~/.wpsecscan/{signatures,payloads}/) · i18n stub (en + es) |

---

Output formats

Every scan produces:

| Flag | File | Use case |
|---------------------|--------------------------|-----------------------------------------|
| (default) | <host>-<ts>.html | Open in a browser. Has copy-to-clipboard buttons for every command, color-coded exploit playbooks, and a "🖨 Print / Save as PDF" button in the top-right corner. |
| (default) | <host>-<ts>.json | Includes per-finding confidence (low/medium/high) and per-check tags (OWASP Top 10 + MITRE ATT&CK). For downstream tooling. |
| --csv | <host>-<ts>.csv | Spreadsheet import. Cells are escaped against Excel formula-injection. |
| --sarif | <host>-<ts>.sarif | GitHub Code Scanning, Azure DevOps, anything that ingests SARIF 2.1.0. |
| --json-only | suppresses HTML | CI / scripted use. |
| --md | <host>-<ts>.md | Markdown report for Confluence / GitHub / Slack threads. |
| --xlsx | <host>-<ts>.xlsx | Excel workbook with per-OWASP-category sheets. |
| --har FILE.har | FILE.har | HAR 1.2 recording of every HTTP request (Cookie/Authorization redacted). Replay with --replay-har. |
| --burp-export | <host>-<ts>-burp-scope.xml | Burp Suite scope XML for hand-off to manual testing. |
| --exec-pdf | <host>-<ts>-exec.pdf | One-page non-technical executi. Uses reportlab if installed, else writes a print-friendly HTML file. |

Round-54 CLI additions

| Flag | Purpose |
|---------------------------------------|------------------------------------------------------------------------------------------|
| --fail-on critical\|high\|medium | O exit-code logic — non-zero only when a finding meets or exceeds the threshold. |
| --diff-against BASELINE.json | Compute the NEW / RESOL vs a saved JSON report, print to stdout. |
| --shell | After scan, drop into a Python REPL with report pre-bound (for power users / IR). |
| --replay-har HAR_FILE | Re-run every request in a HAR file; optionally o the origin with <target>. |
| --daemon CONFIG.yml | Cron-style scheduled scans driven by a YAML config (no Task Scheduler required). |
| --abuseipdb-token TOKEN | Enables the AbuseIPDB reputation check for the target's IP. |
| -- TOKEN | Enables URL/IP enrichment. |
| --github-search-token PAT | Enables GitHub code-search for the target's domain + common secret prefixes. |

Round-56 flags

| Flag | Purpose |
|---------------------------------------|------------------------------------------------------------------------------------------|
| --demo | Synthetic scan against a fake target — every check fires fake findings, every integration fires a fake activity event. Writes one of every artifact to ~/.wpsecscan/demo/. Great for screenshots, smoke-testing an install, or training new users. |
| --no-live | Disable the li rich dashboard during scans. The static console reporter still renders at the end. Useful for CI logs / piped output. |

---

Power-user features (GUI)

Risk score: 0–100, color-coded. Calculated from se weights with per-tier caps.

Profiles (File → Profiles): save the current toggle/pacing/threshold set as "Quick", "Deep", "Audit" etc. Loads with one click. Stored in ~/.wpsecscan/profiles.json.

Recent URLs: the URL field is a dropdown of the last 20 scanned sites.

Diff with last scan: button appears after a scan if a previous JSON for the same URL exists in ~/.wpsecscan/reports/. Shows [NEW] / [RESOLVED] per finding.

Multi-target scan (Tools → Multi-target): paste/load a list of URLs, scan each in turn, one-row-per-site dashboard with risk score and Δ-.

Scheduled recurring scan (Tools → Schedule): registers a Windows Task Scheduler job (WPSecScan_<host>) that runs daily/weekly/monthly at a chosen time. Outputs to a folder you pick. Remove with schtasks /Delete /TN WPSecScan_<host> /F.

Risk-score trend (Tools → Show risk trend): ASCII sparkline of historical scores for the current URL.

Webhook notify (File → Settings → "Webhook notify"): one POST to Slack/Discord/Teams/PagerDuty when a scan finds ≥ chosen se. Hosts against an allow-list — won't post to arbitrary URLs or raw IPs.

Finding annotations: right-click any finding → "Accepted risk" / "False positive" with an optional note. Persisted per-URL in ~/.wpsecscan/annotations.json.

Filter pills: Only NEW (vs last scan), Only CONFIRMED (signature engine actively ), Hide annotated, per-se show/hide.

Exploit playbook: every finding's detail pane includes concrete attacker-side commands (curl PoCs · sqlmap · Metasploit · nuclei · wpscan · ffuf) with {target} already substituted, plus a plain-English *"How an attacker uses this"* paragraph.

OWASP + MITRE chips: every check is tagged with its OWASP Top 10 category (e.g. A03:2021) and MITRE ATT&CK technique (e.g. T1190). Shown inline in the GUI and console.

Exploit confidence: each finding carries a confidence badge (HIGH / MED / LOW) separate from se — [CONFIRMED] findings are HIGH; presence of a WAF downgrades unconfirmed findings by one tier.

Cancel-mid-scan: clicking Cancel during the 20-min deep throttle test returns a partial result with what was learned so far.

---

CLI flag reference (most-used)

---

Configuration files

E is stored in ~/.wpsecscan/ (i.e. C:\Users\<you>\.wpsecscan\):

| Path | Purpose |
|----------------------------------------------|----------------------------------------------------------|
| history.json | Last 20 scanned URLs (GUI dropdown) |
| profiles.json | Named scan profiles (toggles + deep-throttle settings) |
| settings.json | Tokens saved via the GUI onboarding wizard |
| sites.json | Managed-sites list for wpsecscan sites + scheduling |
| schedule_state.json | Cron-style state for wpsecscan schedule |
| digest.json | Configured SMTP / webhook digest destinations |
| annotations.json | Per-finding annotations (accepted-risk / FP) |
| comments.json | Per-finding free-text comments |
| stars.json | Starred findings (GUI sidebar) |
| disabled_checks.json | Persistently disabled check IDs |
| reports/{host}.json | Latest-scan snapshot per URL (canonical) |
| reports/{host}-{YYYYmmdd-HHMMSS}.json | Timestamped snapshot history (for compare, trend) |
| cache/wporg/{slug}.json | 24h-cached wp.org plugin metadata (plugin_cemetery) |
| checkpoints/ | --checkpoint resumable scan state |
| logs/ | --debug log files |
| demo/ | --demo synthetic-scan artifacts |
| analytics/events.jsonl | Opt-in analytics (off by default; wpsecscan analytics) |
| wordfence.json | Local cache of the aggregated C |

O the base dir with the WPSECSCAN_HOME en .

Shell completions

Restart the shell to activate.

Secrets via env vars

Every sensitive flag — --auth-pass, --auth-app-password,
--companion-token, --proxy-auth, --wpscan-token,
--patchstack-token, --hibp-token, --, --abuseipdb-token,
--github-search-token — reads from a matching WPSECSCAN_<UPPER>
en when not passed on the CLI. Use --auth-pass -
to read the password from stdin via getpass (stops it leaking into
ps aux / shell history).

---

Safety

Use only on sites you own or ha permission to test. Online password

brute-force is permanently out of scope. The "deep throttle" probe uses a synthetic
non-existent username and a fixed wrong password — it maps your defense, it does
not guess passwords.

All acti are read-only. The payload library is enforced at load-time

with a pytest in that scans for any write-side operations.

The webhook URL allow-list rejects raw IPs, internal addresses (incl. AWS metadata

at 169.254.169.254), and unknown hosts.

Authenticated scans run with the credentials you provide but never log them.

The scheduled-task URL enforces a strict regex to prevent shell-meta

injection in the registered schtasks command.

---

Troubleshooting

"Windows protected your PC" SmartScreen warning — click *More info → Run anyway*.
The binaries aren't code-signed.

Defender quarantines wpsecscan.exe with Backdoor:JS/Chopper.GG!dha — known false positive.
This is a defensi: to detect webshells (China Chopper, c99, r57) on your sites
it ships references to those attack patterns. Defender's pattern-matching heuristic flags
the .exe e it ne any of those patterns locally. The same kind of
detection trips sqlmap, Metasploit, nuclei, and Gophish — all legitimate security tools.

Three ways to fix it:

1. In the GUI: a dialog pops up on first launch with an "Add exclusion now (UAC)"
button. You can also open it any time via *Tools → Add Windows Defender exclusion...*

2. From admin PowerShell (manual, one line):

Replace C:\path\to\dist with the actual folder containing the .exe binaries.

3. Via the bundled helper script (auto-detects the binary location, prompts UAC):

To restore a quarantined file: *Windows Security → Virus & threat protection →
Protection history → Allow*.

This program does NOT:

Install a backdoor on your computer.

Open any listening port on your machine.

Send data anywhere except to the WordPress URLs you type in.

Run any of the webshells in its signature list — those are strings used to RECOGNISE

webshells on *your sites*, not to execute them.

"DB: not loaded — click Refresh" in the GUI — click *Refresh vuln DB*. Or from the CLI: wpsecscan.exe --update-db.

Scan stalls on a hung target — --timeout 5 cuts the per-request wait.

Multi-target scan freezes for one bad URL — each URL has its own per-request
timeout. If one consistently hangs, drop it from the list.

Cron / scheduled-task entries pile up — list them with schtasks /Query /TN WPSecScan_* and remo with schtasks /Delete /TN <name> /F.

GUI crashes immediately on launch — check C:\Users\<you>\.wpsecscan\ is writable.
Run from a terminal to see the traceback: wpsecscan-gui.exe (the windowed
build suppresses console output by design — run via python run_gui.py from a checkout
to see errors).

---

In

| Category | Count |
|---------------------------|-------|
| Checks | 226 |
| Payloads | 224 |
| Exploit signatures | 307 |
| Plugin C | ~7,000 (Wordfence) + 7 other sources via the nightly aggregator |
| Exploit-playbook entries | 25 |
| Tests | 667 |

---

License & disclaimer

Licensed under AGPLv3+ (from v1.9.0 onward — v1.0.0..v1.8.0 were MIT).
See LICENSE and NOTICE.

AGPL network clause: if you run a modified WPSecScan as a hosted service
(SaaS, web UI, paid scanning tier), you must publish your modified source
under the same AGPLv3+ terms. Private internal use and modifications stay
private. For commercial-distribution licensing terms outside AGPLv3,
contact .

This tool is for defensive use on sites you own. Use against third-party
sites without explicit written permission is illegal in most jurisdictions
under the Computer Fraud and Abuse Act (US) / Computer Misuse Act (UK) /
equi laws elsewhere.

The authors take no responsibility for misuse.

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Defensive WordPress security scanner — 189 checks, 8-source nightly CVE aggregator, SLSA L3 + Sigstore-signed releases, 10-provider threat-intel federation, continuous monitoring, active exploit verification (consent-gated), enterprise SSO/RBAC/audit/multi-tenant, distribution to Docker/K8s/Homebrew/Snap/winget/AUR. AGPLv3.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。