# Wpscan

> Use for WordPress-specific assessment during authorized pentests. Trigger on confirmed WordPress installations, plugin and theme exposure review, version identification, and WordPress-focused retesting.

- Skill: `timsonner/wpscan` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/wpscan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/wpscan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/wpscan

---


# WPScan

## Purpose

Use this skill when the confirmed target is WordPress and the methodology calls for CMS-specific review.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Discovery and Reconnaissance, Retest and Closure

## Use When

- Need to confirm WordPress version, plugins, or themes.
- Need WordPress-specific exposure review instead of generic web checks alone.
- Need a focused retest after WordPress hardening changes.

## Avoid When

- The target is not confirmed as WordPress.
- Enumeration depth would exceed the agreed impact level.

## Inputs

- Confirmed WordPress URL
- Allowed enumeration depth and authentication context
- Scope exclusions for admin workflows

## Procedure

1. Confirm the target is WordPress.
2. Start with passive or low-impact identification.
3. Review versions, plugins, and themes that materially affect risk.
4. Manually validate important findings before escalation.
5. Preserve the exact enumeration approach for retest.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Enumerate plugins, themes, and users (passive)
wpscan --url https://blog.contoso.com --enumerate p,t,u

# API-token assisted scan for vulnerability data
wpscan --url https://blog.contoso.com --api-token <TOKEN> --enumerate vp,u

# Aggressive plugin detection
wpscan --url https://blog.contoso.com --enumerate p --plugins-detection aggressive

# Credential spray against a known user
wpscan --url https://blog.contoso.com --usernames admin --passwords passwords.txt

# Output results to JSON
wpscan --url https://blog.contoso.com --enumerate p,t,u -o contoso-wp.json --format json

# Disable TLS validation for test environments
wpscan --url https://blog.contoso.com --enumerate p,t,u --disable-tls-checks
```

## Evidence to Capture

- WordPress version and exposed plugin or theme surface
- CMS-specific findings requiring remediation
- Exact enumeration scope used during testing

## Safety Boundaries

- Prefer passive or low-impact checks first.
- Do not broaden enumeration or auth testing without explicit approval.