PAGES
← all tools
◆ Web Application Security

wpprobe

v0.12.6 open-source

WPProbe scans WordPress sites to detect installed plugins and themes, then maps them to known vulnerabilities from Wordfence and WPScan databases.

source ↗ rss ↗ What is a cyber toolchain? last repo push Jun 23, 2026

Summary

wpprobe is an open-source command-line scanner that enumerates WordPress plugins and themes on a target site and maps them to known vulnerabilities, and it costs nothing to use. It detects plugins mainly through REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. enumeration and themes through HTML discovery, covering over 5000 plugins without brute-forcing, with a bruteforce or hybrid mode available for broader coverage against directories directly; findings are cross-referenced against a vulnerability database pulled from WPScan or Wordfence data. It is aimed at penetration testers and bug bounty hunters doing WordPress recon rather than at developers securing their own sites, and it sits in the CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly.-scanning corner of web-app security alongside tools like WPScan, though WPProbe leans on unauthenticated REST API fingerprinting for stealth. First committed in 2025, it has 11 contributors, 84 commits in the past year, and a release 43 days ago, so it is actively maintained.

WPProbe scans WordPress sites to detect installed plugins and themes, then maps them to known vulnerabilities from Wordfence and WPScan databases.

How wpprobe helps

Which plugins and themes is this WordPress site actually running?

fingerprints installed plugins through REST API endpoint matching and themes through HTML discovery, covering over 5000 plugins without touching the filesystem directly

Does this target have any known vulnerable plugins or themes on it?

cross-references every detected slug and version against a vulnerability database sourced from WPScan and Wordfence and lists the matching CVEs with exploitability context

Am I missing plugins that stealthy detection can't see?

switches to a bruteforce or hybrid mode that checks directories directly, trading stealth for coverage of thousands more plugins than REST enumeration alone reaches

Can I check a whole list of WordPress sites in one pass?

accepts multiple targets and threads the scan across them, producing the same plugin/theme/vulnerability findings per host

Which of my targets are exposed to a specific CVE I care about?

searches the vulnerability database by CVE identifier or by plugin name and returns the matching entries without requiring a live scan first

Is my vulnerability data stale before I trust a scan's results?

flags when the local vulnerability database is out of date and prompts an update before results are reported

all 10 features, with the evidence for each →

Languages

Not documented

Features

10 capabilities across 2 capability groups · 3 backed by code, an API document or a real run

Built from wpprobe's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • wpprobe covers 2 of the 8 vulnerability assessment methods capabilities we track.

What wpprobe offers you

  • Command-line interface4
  • REST API1
Vulnerability database matching 2 features Vulnerability assessment methods since 2025
Vulnerability database management verified Fetches and updates the local Wordfence vulnerability database used to identify known WordPress vulnerabilities. 7 releases · 3 other sources · first seen Feb 2025

Shared capability: Vulnerability database matching

Also counts toward: Command-line interface

release 7 total

  • Falls back to the GitHub release asset for the vulnerability database when no Wordfence API key is configured. v0.10.16 · Mar 2026 · source · release history
  • Displays a warning when the local vulnerability database is outdated, prompting users to update before scanning. v0.10.16 · Mar 2026 · source · release history
  • Adds DatabaseExists helper to check whether the local vulnerability database is present before scanning. v0.10.0 · Dec 2025 · source · release history
  • Integrates WPScan Enterprise vulnerability database for enriched plugin CVE/vuln data during scans. v0.9.0 · Dec 2025 · source · release history
  • Adds wpprobe update-db command to pull the latest WPScan vulnerability database automatically. v0.9.0 · Dec 2025 · source · release history
  • Docker image now provides /data and /config volume mounts for persistent vulnerability databases between runs. v0.9.0 · Dec 2025 · source · release history

command line

  • --api-key — Wordfence API key (or set WORDFENCE_API_KEY env var) v0.10.16 · Mar 2026 · command-line history
  • update-db — Update the Wordfence vulnerability database v0.7.4 · Jul 2025 · command-line history

example

  • Pull the latest WPScan Enterprise vulnerability database before scanning, using your API token. WPSCAN_API_TOKEN=your_token_here wpprobe update-db v0.9.0 · Dec 2025 · source
Vulnerability query shipped Searches the cyber tooling's local vulnerability database by CVE identifier or plugin name to retrieve details about known WordPress vulnerabilities. 2 other sources

Shared capability: Vulnerability database matching

example

  • Search vulnerabilities by CVE wpprobe search --cve CVE-2024-1234
  • Search vulnerabilities by plugin name wpprobe search --plugin woocommerce
Web vulnerability scanning 1 feature Vulnerability assessment methods since 2025
Credential brute-forcing shipped Performs bruteforce and hybrid credential attacks against WordPress sites to discover valid usernames and passwords. 1 release · 1 other source · first seen May 2025

Shared capability: Web vulnerability scanning

release

  • Adds a bruteforce/hybrid scanner for credential attacks against WordPress sites. v0.6.0 · May 2025 · source · release history

example

  • Scan using brute-force mode wpprobe scan -u https://example.com --mode bruteforce
Other / not yet classified 7 features Features we have not matched to a capability yet. A suggested match is marked.
Plugin enumeration shipped suggested Discovers WordPress plugins on a target by combining REST API enumeration with file-based bruteforce directory checks, including a hybrid mode for broader coverage. 7 releases · 5 other sources · first seen Feb 2025

Suggested capability: Web vulnerability scanning. This is our guess, not confirmed.

Also counts toward: REST API

release 7 total

  • Automatically selects hybrid mode and calibrates detection against hosts that fabricate plugin content, reducing false positives on deceptive WordPress targets. v0.12.6 · Aug 2026 · source · release history
  • Adds calibrated file-based plugin bruteforce, improving accuracy of direct directory-check detection by tuning request logic to reduce false positives. v0.12.0 · Jun 2026 · source · release history
  • Adds /feed/ (RSS feed endpoint) as a new plugin discovery source during stealth scans, expanding enumeration coverage without triggering common detection signatures. v0.10.13 · Feb 2026 · source · release history
  • Adds MaxRedirects option to control the maximum number of HTTP redirects followed during scanning. v0.10.0 · Dec 2025 · source · release history
  • Delivers up to 31% faster plugin detection performance. v0.9.0 · Dec 2025 · source · release history
  • Extracts plugin slugs from /wp-content/uploads to surface plugins missed by traditional path probing. v0.7.1 · Jun 2025 · source · release history

example

  • Use hybrid mode on a target list to get stealthy REST API coverage first, then apply calibrated bruteforce for maximum plugin discovery. wpprobe scan -f targets.txt -t 20 --mode hybrid -o results.json v0.12.0 · Jun 2026 · source
  • Run a bruteforce scan against a WordPress target to enumerate plugins beyond what REST API enumeration can detect. wpprobe scan -u https://example.com --mode bruteforce v0.12.0 · Jun 2026 · source
  • Scan a single WordPress target wpprobe scan -u https://example.com
  • Scan multiple targets with threading wpprobe scan -f targets.txt -t 20
  • Scan using hybrid mode wpprobe scan -u https://example.com --mode hybrid
CSV output field customization shipped Provides structured CSV output with configurable column headers for plugin/theme slugs and types. 3 releases · first seen Mar 2026

release

  • The Plugin column in CSV output is renamed to Slug; any downstream scripts or pipelines parsing CSV output by column name will break. v0.11.2 · Mar 2026 · source · release history
  • Renames the Plugin column header to Slug in CSV output for accuracy across both plugins and themes. v0.11.2 · Mar 2026 · source · release history
  • Adds a Type column to CSV output, surfacing whether each finding is a plugin or theme. v0.11.2 · Mar 2026 · source · release history
Theme enumeration shipped suggested Discovers WordPress themes on a target and identifies vulnerabilities associated with them via a unified software model. 2 releases · 1 other source · first seen Mar 2026

Suggested capability: Web vulnerability scanning. This is our guess, not confirmed.

Also counts toward: Command-line interface

release

  • Adds theme detection alongside plugin detection, backed by a composite vulnerability index and unified software model. v0.11.0 · Mar 2026 · source · release history
  • Displays detected themes in the CLI output tree under a dedicated Themes section, separate from Plugins. v0.11.0 · Mar 2026 · source · release history

docs

  • WordPress plugin and theme scanner that detects installations via REST API enumeration and HTML discovery, then maps findings to known CVEs.
Proxy support verified Routes outbound HTTP/HTTPS requests through a configurable proxy server. 2 other sources · first seen Aug 2025

Also counts toward: Command-line interface

command line

Rate limiting verified Controls the maximum number of requests per second to avoid overwhelming target systems. 2 other sources · first seen Dec 2025

command line

Automated false-positive mitigation shipped Automatically selects detection modes and calibrates against deceptive WordPress targets to reduce false positives. 1 release · first seen Mar 2026

release

  • Renames the Plugin column header to Slug in CSV output for accuracy across both plugins and themes. v0.11.2 · Mar 2026 · source · release history
Uninstall support shipped Provides a command to cleanly remove the cyber tool from the system after an assessment or when switching versions. 1 release · first seen Feb 2025

Also counts toward: Command-line interface

release

  • Adds uninstall command to remove wpprobe from the system. v0.5.2 · Feb 2025 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for wpprobe, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail wpprobe puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

12 entries

  1. August 20261
  3. June 20261
  5. March 20263
  9. February 20261
  11. December 20252
  14. June 20251
  16. May 20251
  18. February 20252
    Show

    12 entries

    1. v0.12.6 Aug 22, 2026 · release notes

      wpprobe v0.12.6 auto-selects hybrid mode and calibrates against hosts that fabricate plugin content

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.12.6 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.12.6
    2. v0.12.0 Jun 21, 2026 · issue 001

      wpprobe v0.12.0 adds calibrated file-based plugin bruteforce for deeper WordPress plugin enumeration.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.12.0 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.12.0
      └──▷ TRY IT
      Run a bruteforce scan against a WordPress target to enumerate plugins beyond what REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. enumeration can detect.
      $ wpprobe scan -u https://example.com --mode bruteforce
      Use hybrid mode on a target list to get stealthy REST API coverage first, then apply calibrated bruteforce for maximum plugin discovery.
      $ wpprobe scan -f targets.txt -t 20 --mode hybrid -o results.json
      • Adds calibrated file-based plugin bruteforce, improving accuracy of direct directory-check detection by tuning request logic to reduce false positives.

      1 detail in Everything

    3. v0.11.2 Mar 19, 2026 · release notes

      wpprobe v0.11.2 adds a Type column to CSV output to distinguish plugin vs. theme entries.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.11.2 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.11.2
      • Adds a Type column to CSV output, surfacing whether each finding is a plugin or theme.
      • Renames the Plugin column header to Slug in CSV output for accuracy across both plugins and themes.

      2 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The Plugin column in CSV output is renamed to Slug; any downstream scripts or pipelines parsing CSV output by column name will break.
    4. v0.11.0 Mar 16, 2026 · release notes

      wpprobe v0.11.0 adds WordPress theme detection with vulnerability indexing and a sectioned Plugins/Themes CLI tree view.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.11.0 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.11.0
      • Adds theme detection alongside plugin detection, backed by a composite vulnerability index and unified software model.
      • Displays detected themes in the CLI output tree under a dedicated Themes section, separate from Plugins.

      2 details in Everything

    5. v0.10.16 Mar 11, 2026 · release notes

      wpprobe v0.10.16 adds GitHub release fallback for vuln DB and warns when the database is outdated

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.10.16 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.10.16
      • Falls back to the GitHub release asset for the vulnerability database when no Wordfence API key is configured.
      • Displays a warning when the local vulnerability database is outdated, prompting users to update before scanning.

      2 details in Everything

    6. v0.10.13 Feb 8, 2026 · release notes

      wpprobe v0.10.13 adds RSS feed as a stealth plugin discovery source for stealthier WordPress enumeration.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.10.13 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.10.13
      • Adds /feed/ (RSS feed endpoint) as a new plugin discovery source during stealth scans, expanding enumeration coverage without triggering common detection signatures.
      • Adds FormatSuccess to the logger for consistent success-state output formatting.

      2 details in Everything

    7. v0.10.0 Dec 27, 2025 · release notes

      wpprobe v0.10.0 adds a public API package, MaxRedirects control, and a vulnerability database existence check.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.10.0 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.10.0
      • New public API package exposes wpprobe functionality for programmatic use.
      • Adds MaxRedirects option to control the maximum number of HTTP redirects followed during scanning.
      • Adds DatabaseExists helper to check whether the local vulnerability database is present before scanning.

      3 details in Everything

    8. v0.9.0 Dec 26, 2025 · release notes

      wpprobe v0.9.0 adds WPScan Enterprise vulnerability database integration and a 31% faster plugin detection engine.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.9.0 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.9.0
      └──▷ TRY IT
      Pull the latest WPScan Enterprise vulnerability database before scanning, using your API token.
      $ WPSCAN_API_TOKEN=your_token_here wpprobe update-db
      • Integrates WPScan Enterprise vulnerability database for enriched plugin CVE/vuln data during scans.
      • Adds wpprobe update-db command to pull the latest WPScan vulnerability database automatically.
      • Docker image now provides /data and /config volume mounts for persistent vulnerability databases between runs.
      • Delivers up to 31% faster plugin detection performance.

      4 details in Everything

    9. v0.7.1 Jun 17, 2025 · release notes

      wpprobe v0.7.1 adds plugin slug extraction from /wp-content/uploads for broader WordPress plugin discovery.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.7.1 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.7.1
      • Extracts plugin slugs from /wp-content/uploads to surface plugins missed by traditional path probing.

      1 detail in Everything

    10. v0.6.0 May 27, 2025 · release notes

      wpprobe v0.6.0 adds a bruteforce/hybrid scanner for WordPress targets.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.6.0 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.6.0
    11. v0.5.2 Feb 25, 2025 · release notes

      wpprobe v0.5.2 adds an uninstall command and optimizes vulnerability loading.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.5.2 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.5.2
      └──▷ TRY IT
      Cleanly remove wpprobe from your system after an assessment or to switch versions.
      $ wpprobe uninstall
      • Adds uninstall command to remove wpprobe from the system.

      1 detail in Everything

    12. v0.4.0 Feb 22, 2025 · release notes

      wpprobe v0.4.0 expands plugin coverage, adds Auth/Unauth vuln categorization, and enriches output detail.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.4.0 https://github.com/Chocapikk/wpprobe.git
# already have the repo? check out this version:
$ git checkout v0.4.0
      • Adds more WordPress plugins to the scanning list, broadening detection surface.
      • Introduces Auth/Unauth distinction in vulnerability categorization, clarifying exploitability context.
      • Expands output files with greater detail for richer post-scan insights.

      3 details in Everything

    Project health

    Issue, contributor and maintainer activity in Chocapikk/wpprobe, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 3 −6 vs prior 12 months
    2. Maintainers 1 +0 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 2 days first maintainer reply 3 hours
    6. Open backlog 0 of 16 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 0
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 946
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback