/wpscan

description: WordPress-specific vulnerability scanning and enumeration
allowed-tools: ToolSearch, Bash, Read, Write
argument-hint: <wordpress-url>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

WordPress Security Scan

Target: `$ARGUMENTS`

Execute WordPress-specific scanning using Hexstrike MCP tools.

Step 1: Load Tools

Use ToolSearch to load:

• `wpscan_analyze` — comprehensive WordPress vulnerability scanning
• `nuclei_scan` — template-based scanning with WP-specific templates
• `katana_crawl` — crawl for custom theme/plugin endpoints

Step 2: WPScan Enumeration

Run `wpscan_analyze` against the target to:

• Detect WordPress version
• Enumerate plugins (aggressive mode if stealth is not required)
• Enumerate themes
• Enumerate users (author ID brute force)
• Check for known vulnerabilities in detected components
• Identify interesting files (readme.html, license.txt, wp-config.php.bak)

Step 3: Nuclei WP Templates

Run `nuclei_scan` with WordPress-specific template tags:

• `wordpress`, `wp-plugin`, `wp-theme`
• Severity: critical, high, medium
• This catches vulnerabilities that WPScan's database might miss

Step 4: Custom Endpoint Discovery

Run `katana_crawl` to discover:

• Custom PHP endpoints in theme directories (`/wp-content/themes/*/`)
• Custom plugin endpoints
• AJAX handlers (`/wp-admin/admin-ajax.php` actions)
• REST API custom routes (`/wp-json/`)
• Hidden admin tools or utilities

Step 5: Manual Checks

Verify these common WordPress attack vectors:

• XML-RPC enabled? (`/xmlrpc.php` — can be used for brute force, SSRF, DoS)
• User enumeration via `/?author=1`, `/?author=2`, etc.
• Login page accessible? (`/wp-login.php`)
• WP-Cron accessible? (`/wp-cron.php`)
• Debug mode enabled? (error messages in responses)
• Directory listing in `/wp-content/uploads/`

Step 6: Results

Save findings to `wpscan-{target}.md` in the project directory, organized by:

• WordPress version and update status
• Vulnerable plugins/themes with CVEs
• Enumerated users
• Accessible sensitive endpoints
• Custom theme/plugin findings
• Recommended exploitation paths