WordPress Security Scanner

WPScan WordPress Vulnerability Database - WordPress Security Plugin

• (Optional but highly recommended: rbenv)
• Ruby >= 3.3 - Recommended: latest stable
• Curl >= 7.72 - Recommended: latest stable
  • The 7.29 has a segfault
  • The < 7.72 could result in Stream error in the HTTP/2 framing layer in some cases
• RubyGems - Recommended: latest stable
• Nokogiri might require packages to be installed via your package manager depending on your OS, see https://nokogiri.org/tutorials/installing_nokogiri.html

When using a pentesting distribution (such as Kali Linux), it is recommended to install/update wpscan via the package manager if available.

brew install wpscanteam/tap/wpscan

WPScan depends on gems with native extensions (e.g. yajl-ruby, nokogiri, ffi), so a working C toolchain and Ruby development headers must be present before gem install wpscan. Without them, the install fails with errors like Failed to build gem native extension or make: x86_64-linux-gnu-gcc: No such file or directory (see #1844).

• Debian / Ubuntu:

  sudo apt install build-essential ruby-dev

• Fedora / RHEL / CentOS:

  sudo dnf install @development-tools ruby-devel

• Arch Linux:

  sudo pacman -S base-devel ruby

• Alpine:

  sudo apk add build-base ruby-dev

• macOS: install the Xcode Command Line Tools (xcode-select --install).

Then install the gem:

gem install wpscan

On MacOSX, if a Gem::FilePermissionError is raised due to Apple's System Integrity Protection (SIP), either install RVM and install wpscan again, or run sudo gem install -n /usr/local/bin wpscan (see #1286)

You can update the local database by using wpscan --update

Updating WPScan itself is either done via gem update wpscan or the packages manager (this is quite important for distributions such as in Kali Linux: apt-get update && apt-get upgrade) depending on how WPScan was (pre)installed