README

WordPress Vulnerability Check (wp-vulnerability-check) is a console application to check the WPScan Vulnerability Database via API to identify the security issues of WordPress plugins installed.

If you're using WordPress as part of your application and thrid-party WordPress plugins to implement your bussiness logic, you can run wp-vulnerability-check on a CI pipeline to check the vulnerabilities. You should get a token from wpscan.com in order to have access to the API.

Table Of Contents

• How To Use
  • Requirements
  • Installation
  • CLI Options
• Issues
• Contributing

How To Use

Requirements

wp-vulnerability-check requires PHP version 5.6.0 or greater.

Installation

It can be installed as a stand-alone tool or used as a test step on your CI pipeline.

composer require umutphp/wp-vulnerability-check

CLI Options

After succesfull installation, you can display the options as follows;

 ./wp-vulnerability-check --help
---------------------------
WP Vulnerability Check version 0.2.2
---------------------------
Usage: wp-vulnerability-check [options]
Options:
    --config            Full path for the YAML config file. A sample config
                        file is .wvc.yml.sample in root folder. CLI arguments
                        override the values in config file.
    --path              Full path of your WordPress installation.
    --plugins-path      Relative path of the plugin folder. It is optional.
                        Please specify if you don't use default plugin folder.
    --mu-plugins-path   Relative path of the mu plugin folder. It is optional.
                        Please specify if you don't use default mu plugin folder.
    --themes-path       Relative path of the theme folder. It is optional.
                        Please specify if you don't use default theme folder.
    --token             Token got from wpscan.com
    --exclude           Exclude the plugins given in comma separated format.
    --output            The format of output. Valid values JSON, READABLE, HTML,
                        NO (Default).
    --no-colors         Disable the console colors. It is enabled by default.
    --version           Show version.
    --help              Print this help.

A sample excution,

$ ./wp-vulnerability-check --path /path/to/plugins/ --token token --output readable

Checking WordPress version ...

.
------------------------------------------------------------
Vulnerability Details


Checking plugins...

.......

Checked 7 plugins in 2 second, no vulnerability found.

The plugins which are not in WPScan Vulnerability Database; akismet, custom-css-js, hello, multisite-clone-duplicator, wp-migrate-db, base, mu-autoloader.
PS: You can exclude your custom plugins with --exclude parameter.

Checking theme...

.

Checked 1 theme in 0.2 second, no vulnerability found.

The theme which is not in WPScan Vulnerability Database; simple-days.
PS: You can exclude your custom themes with --exclude parameter.

Issues

Bug reports and feature requests can be submitted on the Github Issue Tracker.

Contributing

See CONTRIBUTING.md for more information.

Code Of Conduct

See CODE_OF_CONDUCT for more information.