WordPress Scanner
Actively enumerate WordPress core, known-vulnerable plugins/themes, and usernames, and check them against our own vulnerability database.
Monitor this automatically
NetTests can run this check on a schedule, preserve historical results, compare changes over time, and alert you the moment something breaks.
Start monitoring free → See all monitoring productsFrequently Asked Questions
What does this scanner check?
It detects the WordPress core version, installed plugins/themes, and valid usernames, then checks each component against our own vulnerability database for known Common Vulnerabilities and Exposures (CVEs). Detection combines passive parsing of the homepage with active probing — see the next question.
How does it detect plugins and themes that don't load anything on the homepage?
Two techniques, combined. Passively: WordPress includes a version query string (?ver=1.2.3) on each plugin/theme asset Uniform Resource Locator (URL) by default, so parsing the homepage's source directly reveals the slug and exact version for everything actually loaded there — free, but blind to anything not loaded on that one page (admin-only plugins, backend-only tooling). Actively: it also probes (readme.txt / style.css) for every plugin and theme slug our own vulnerability database already tracks as having a known CVE, confirming components the homepage alone wouldn't reveal. It doesn't try to enumerate all 60,000+ possible WordPress.org plugin slugs the way a full external scan might — that's infeasible here, and mostly just inventories what's installed rather than what's actually risky.
Does it enumerate WordPress usernames?
Yes. It checks the REST API user list (/wp-json/wp/v2/users) first, and if that's disabled, falls back to probing author-archive IDs — WordPress redirects /?author=N to /author/<username>/ for a valid user even with the REST API locked down. A discovered username narrows the field for credential-stuffing or brute-force attempts, even though it isn't a vulnerability by itself.
Why does this require authentication?
This tool actively probes a live target with many requests. Authentication and target-ownership verification ensure users only scan infrastructure they control.
Where does the vulnerability data come from?
We maintain our own vulnerability database, refreshed automatically. Results are looked up against our own records, not fetched live from a third party at scan time.