WordPress Vulnerability Check (wp-vulnerability-check) is a console application to check the WPScan Vulnerability Database via API to identify the security issues of WordPress plugins installed.
If you're using WordPress as part of your application and thrid-party WordPress plugins to implement your bussiness logic, you can run wp-vulnerability-check on a CI pipeline to check the vulnerabilities. You should get a token from wpscan.com in order to have access to the API.
Table Of Contents
wp-vulnerability-check requires PHP version 5.6.0 or greater.
It can be installed as a stand-alone tool or used as a test step on your CI pipeline.
composer require umutphp/wp-vulnerability-check After succesfull installation, you can display the options as follows;
./wp-vulnerability-check --help --------------------------- WP Vulnerability Check version 0.2.2 --------------------------- Usage: wp-vulnerability-check [options] Options: --config Full path for the YAML config file. A sample config file is .wvc.yml.sample in root folder. CLI arguments override the values in config file. --path Full path of your WordPress installation. --plugins-path Relative path of the plugin folder. It is optional. Please specify if you don't use default plugin folder. --mu-plugins-path Relative path of the mu plugin folder. It is optional. Please specify if you don't use default mu plugin folder. --themes-path Relative path of the theme folder. It is optional. Please specify if you don't use default theme folder. --token Token got from wpscan.com --exclude Exclude the plugins given in comma separated format. --output The format of output. Valid values JSON, READABLE, HTML, NO (Default). --no-colors Disable the console colors. It is enabled by default. --version Show version. --help Print this help. A sample excution,
$ ./wp-vulnerability-check --path /path/to/plugins/ --token token --output readable Checking WordPress version ... . ------------------------------------------------------------ Vulnerability Details Checking plugins... ....... Checked 7 plugins in 2 second, no vulnerability found. The plugins which are not in WPScan Vulnerability Database; akismet, custom-css-js, hello, multisite-clone-duplicator, wp-migrate-db, base, mu-autoloader. PS: You can exclude your custom plugins with --exclude parameter. Checking theme... . Checked 1 theme in 0.2 second, no vulnerability found. The theme which is not in WPScan Vulnerability Database; simple-days. PS: You can exclude your custom themes with --exclude parameter.Bug reports and feature requests can be submitted on the Github Issue Tracker.
See CONTRIBUTING.md for more information.
See CODE_OF_CONDUCT for more information.
