timsonner WPScan
Purpose
Use this skill when the confirmed target is WordPress and the methodology calls for CMS-specific review.
Phase Fit
- Primary: Vulnerability Analysis
- Secondary: Discovery and Reconnaissance, Retest and Closure
Use When
- Need to confirm WordPress version, plugins, or themes.
- Need WordPress-specific exposure review instead of generic web checks alone.
- Need a focused retest after WordPress hardening changes.
Avoid When
- The target is not confirmed as WordPress.
- Enumeration depth would exceed the agreed impact level.
Inputs
- Confirmed WordPress URL
- Allowed enumeration depth and authentication context
- Scope exclusions for admin workflows
Procedure
- Confirm the target is WordPress.
- Start with passive or low-impact identification.
- Review versions, plugins, and themes that materially affect risk.
- Manually validate important findings before escalation.
- Preserve the exact enumeration approach for retest.
Command Syntax
Replace sample targets with approved in-scope assets.
# Enumerate plugins, themes, and users (passive)
wpscan --url https://blog.contoso.com --enumerate p,t,u
# API-token assisted scan for vulnerability data
wpscan --url https://blog.contoso.com --api-token <TOKEN> --enumerate vp,u
# Aggressive plugin detection
wpscan --url https://blog.contoso.com --enumerate p --plugins-detection aggressive
# Credential spray against a known user
wpscan --url https://blog.contoso.com --usernames admin --passwords passwords.txt
# Output results to JSON
wpscan --url https://blog.contoso.com --enumerate p,t,u -o contoso-wp.json --format json
# Disable TLS validation for test environments
wpscan --url https://blog.contoso.com --enumerate p,t,u --disable-tls-checks
Evidence to Capture
- WordPress version and exposed plugin or theme surface
- CMS-specific findings requiring remediation
- Exact enumeration scope used during testing
Safety Boundaries
- Prefer passive or low-impact checks first.
- Do not broaden enumeration or auth testing without explicit approval.