WPSentry

WordPress Security Audit & Exploitation Toolkit

WPSentry is a modular, high-performance, and concurrency-focused security tool designed to fingerprint WordPress installations, perform active security checks, audit local vulnerability databases, and run authorized exploitation simulations.

This repository is a refactored, enhanced, and stabilized edition built upon the original open-source project by @Triotion. We retain the original developer's foundation while significantly expanding coverage, optimizing the architecture for scalability, thread safety, and strict maintenance standards.

---

Key Enhancements in WPSentry

• Strict File-Size Budget: The entire codebase has been modularly decomposed so that no core script exceeds ~300 lines, ensuring maximum maintainability and readability.
• Unified ScanContext: All HTTP sessions, headers, proxy parameters, threads, and logging channels are unified in a single typed configuration container.
• Merged Scan Pipeline: The database-driven vulnerability scanner and active deep security checks are merged into a single standard pipeline, executing both by default for maximum audit coverage.
• Thread-Safe Mass Scanner: The multi-target runner (MassScanner) has been isolated into its own module with full thread isolation, eliminating race conditions under concurrent workloads.
• Dark-Theme HTML Reporting: Generates a high-end, responsive security audit dashboard featuring live logs, categorized accordions, and instant search filtering.
• Expanded Check Coverage: 60+ active probe checks across 6 categories including new CVE-specific plugin probes and hardening audits.

---

Coverage

Fingerprinting

• WordPress core version detection (readme, generator meta, feed headers, style.css)
• Active theme and plugin slug enumeration
• User enumeration via author archives and REST API
• XML-RPC state and system method discovery
• REST API namespace enumeration
• Server software and PHP version disclosure

Database-Driven Vulnerability Auditing

• Local CVE database lookup for WordPress core, plugins, and themes
• Automatic severity mapping (Critical / High / Medium / Low / Info)
• Detects outdated component versions against known exploit records

Information Disclosure Checks

• Exposed wp-config.php, .env, debug.log, .git/config, backup.sql
• PHP error output visible in HTTP responses
• Server version headers (X-Powered-By, Server)
• WordPress version leakage via meta generator and feed
• REST API namespace disclosure (/wp-json/)
• Sitemap user disclosure (/wp-sitemap-users-1.xml)
• XML-RPC method list exposure (system.listMethods)
• Media library direct-access enumeration
• Exposed wp-cron.php endpoint

User Enumeration Checks

• Author archive scanning (?author=1..N)
• REST API user listing (/wp-json/wp/v2/users)
• Login error message differentiation (valid vs. invalid username)
• WooCommerce customer data via unauthenticated REST (/wp-json/wc/v3/customers)

Misconfiguration Checks

• Missing security headers (X-Frame-Options, X-Content-Type-Options, CSP, HSTS, Referrer-Policy, Permissions-Policy)
• wp-login.php brute-force exposure
• Directory listing enabled on plugin/theme/upload directories
• XML-RPC pingback and multicall abuse vectors
• Vulnerable wp-cron.php remote triggering
• Exposed wp-admin/install.php and wp-admin/upgrade.php
• README.html / license.txt version fingerprint files
• Open redirect via wp-login.php?redirect_to=

Injection Checks

• SQL injection probes on search and query parameters
• Reflected XSS on s= (search) and common input parameters
• Path traversal via ..%2F sequences in URL parameters
• Server-Side Request Forgery (SSRF) on media/redirect parameters
• Header injection via Host and X-Forwarded-For manipulation

Plugin-Specific Vulnerability Checks

Two detection layers are used: active probes (endpoint fingerprinting regardless of detected version) and CVE database matching (version comparison against the local signature database).

Active Probes

Plugin	Check	CVE / Reference	Severity
Contact Form 7	Unrestricted file upload probe	CVE-2020-35489	Critical
WP Super Cache	Unauthenticated RCE endpoint probe	CVE-2019-20041	Critical
Yoast SEO	Version disclosure via sitemap header	CVE-2021-25118	Medium
Gravity Forms	Unauthenticated entry listing	CVE-2021-20837	Critical
Elementor	Template import / RCE AJAX endpoint	CVE-2021-24169	High
WooCommerce	Product export endpoint, unauthenticated customer API	CVE-2021-32620, CVE-2021-4095	High/Critical
Wordfence	Diagnostic information endpoint exposure	-	Medium
WP File Manager	Directory traversal / unauthenticated RCE	CVE-2020-25213	Critical
FluentForms	Unauthenticated entry access, file upload path	CVE-2024-3552, CVE-2024-2771	High
WPML	REST API endpoint / SSTI RCE path	CVE-2024-6386	Critical
KiviCare	Authentication bypass via social-login endpoint	CVE-2026-2991	Critical
Pix for WooCommerce	Unauthenticated nonce → file upload chain	CVE-2026-3891	Critical
Social Warfare	swp_debug=load_options Remote Code Execution	CVE-2019-9978	High
UpdraftPlus	Backup directory listing / direct file access	-	Critical
Divi Builder	Unauthenticated et_fb_retrieve_builder_data AJAX	-	Medium

CVE Database Signatures

The following CVEs are matched by version comparison against all detected plugins and themes:

Plugin / Component	Affected Version	Fixed In	CVE ID	CVSS	Type
WPML (sitepress-multilingual-cms)	≤ 4.6.12	4.6.13	CVE-2024-6386	9.9	SSTI / RCE
WPML (sitepress-multilingual-cms)	≤ 4.9.4	4.9.5	CVE-2024-6386 (variant)	9.9	SSTI / RCE
FluentForm	≤ 5.1.5	5.1.6	CVE-2024-2771	8.8	SQL Injection
FluentForm	≤ 6.2.4	6.2.5	CVE-2024-3552	8.1	Arbitrary File Upload / RCE
WordPress Core	≤ 6.4.3	6.4.4	CVE-2024-6307	6.4	XSS via HTML API
Contact Form 7	≤ 5.3.1	5.3.2	CVE-2020-35489	Critical	Unrestricted File Upload / RCE
Contact Form 7	≤ 5.1.8	5.1.9	CVE-2020-12800	Medium	Cross-Site Scripting
WP Super Cache	≤ 1.7.1	1.7.2	CVE-2019-20041	Critical	Unauthenticated RCE
WooCommerce	≤ 5.5.0	5.5.1	CVE-2021-32620	High	Arbitrary File Download
WooCommerce	≤ 4.6.1	4.6.2	CVE-2021-32052	Critical	SQL Injection
WooCommerce (Product Import)	≤ 3.3.4	3.3.5	CVE-2021-4095	Critical	CSV Injection / RCE
WooCommerce (Checkout Editor)	≤ 2.0.2	2.0.3	CVE-2022-0409	High	Unauthorized Field Modification
WooCommerce Currency Switcher	≤ 1.16.2	1.16.3	CVE-2023-23992	Critical	SQL Injection
WP File Manager	≤ 6.8	6.9	CVE-2020-25213	Critical	Unauthenticated RCE
WP Bakery Page Builder	≤ 6.4.1	6.5.0	CVE-2021-34397	Critical	RCE
WP Fastest Cache	≤ 0.9.4	0.9.5	CVE-2021-24869	Critical	RCE
Elementor	≤ 3.1.3	3.1.4	CVE-2021-24169	High	Authenticated RCE
WPForms Lite	≤ 1.6.7.1	1.6.7.2	CVE-2021-34621	High	Authenticated File Upload
Gravity Forms	≤ 2.4.22	2.4.23	CVE-2021-20837	Critical	RCE
Yoast SEO	≤ 14.8	14.9	CVE-2021-25118	Medium	Cross-Site Scripting
Gutenberg	≤ 9.2.0	9.3.0	CVE-2021-22146	Medium	Stored XSS
Yuzo Related Posts	≤ 5.5.8	Abandoned	CVE-2019-9911	High	Stored XSS
wpDataTables	≤ 3.7.0	3.7.1	CVE-2023-26540	Critical	SQL Injection
NextGEN Gallery	≤ 3.8.0	3.8.1	CVE-2021-34107	Critical	SQL Injection

Hardening Audit Checks

• PHP debug output (WP_DEBUG) visible in responses
• Default admin username exists and is guessable
• wp-content/uploads/ missing PHP execution restriction (.htaccess)
• Dangerous HTTP methods enabled (TRACE, OPTIONS)
• Sensitive paths disclosed in robots.txt
• WordPress file editor accessible (DISALLOW_FILE_EDIT not set)
• PHP version EOL status (Critical: 5.x/7.x · High: 8.0/8.1 · Medium: 8.2)

Exploitation Modules (authorized use only)

Method Key	Description
xmlrpc_multicall	XML-RPC system.multicall credential brute-force
user_enumeration	Author archive user enumeration
rest_api_user_enum	REST API /wp/v2/users user harvesting
cf7_file_upload	Contact Form 7 arbitrary file upload
wp_super_cache_rce	WP Super Cache RCE endpoint probe
wp_bakery_rce	WP Bakery unauthenticated RCE
wp_file_manager_rce	WP File Manager directory traversal/RCE
authenticated_rce	Authenticated theme editor shell injection
timthumb_rce	TimThumb CVE-2011-4106 probe
elementor_rce	Elementor template import RCE
wordfence_rce	Wordfence diagnostic endpoint probe
wp_fastest_cache_rce	WP Fastest Cache RCE
woocommerce_file_download	WooCommerce arbitrary file download
wp_core_path_traversal	Core path traversal vector
password_reset_token_leak	Password reset token leakage
woocommerce_product_rce	WooCommerce product import RCE
social_warfare_rce	Social Warfare CVE-2019-9978 RCE
kivicare_auth_bypass	KiviCare CVE-2026-2991 session cookie leak

---

Installation

Prerequisites

• Python 3.8+
• Git

Setup

1. Clone the repository:

git clone https://github.com/wawanwidiantara/wpsentry
cd wpsentry

2. Install dependencies:

pip install -r requirements.txt

3. View options:

python3 wpsentry.py -h

---

Usage Guide

Basic Scan

Runs fingerprinting, database CVE check, and all active security probes:

python3 wpsentry.py -t https://example.com

Verbose Scan

Shows each check result and HTTP response details as they occur:

python3 wpsentry.py -t https://example.com -v

Scan with Authorized Exploitation

Performs the full scan and attempts exploitation of confirmed vectors:

python3 wpsentry.py -t https://example.com --pwn

Export to HTML Report

Saves a dark-theme interactive security audit dashboard:

python3 wpsentry.py -t https://example.com --format html

Export to Markdown Report

python3 wpsentry.py -t https://example.com --format md

Scan via Proxy (e.g. Burp Suite)

python3 wpsentry.py -t https://example.com --proxy http://127.0.0.1:8080 -v

Thread-Safe Mass Target Scan

Reads a file containing one URL per line and scans them concurrently:

python3 wpsentry.py -f targets.txt --threads 10 --batch-dir batch_results

Generate a Targets File

python3 create_targets_list.py -d domains.txt -o targets.txt

Update Vulnerability Database

Downloads the latest CVE signatures and tool updates:

python3 wpsentry.py --db-update

Auto-Sync Before Scan

Syncs the vulnerability database automatically before starting:

python3 wpsentry.py -t https://example.com --auto-sync

---

CLI Reference

usage: wpsentry [-h] [-t TARGET] [-f FILE] [-o OUTPUT] [--threads THREADS]
                [--timeout TIMEOUT] [--user-agent USER_AGENT] [--proxy PROXY]
                [--pwn] [-v] [--batch-dir BATCH_DIR] [--db-update]
                [--auto-sync] [--format {console,html,md}]

WPSentry — WordPress Security & Exploitation Toolkit

options:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        Target WordPress site URL
  -f FILE, --file FILE  File containing list of target URLs (one per line)
  -o OUTPUT, --output OUTPUT
                        Output directory for scan results
  --threads THREADS     Number of threads (default: 5)
  --timeout TIMEOUT     Request timeout in seconds (default: 30)
  --user-agent USER_AGENT
                        Custom User-Agent string
  --proxy PROXY         Proxy URL (e.g., http://127.0.0.1:8080)
  --pwn                 Attempt to exploit found vulnerabilities
  -v, --verbose         Enable verbose output
  --batch-dir BATCH_DIR
                        Base directory for batch scan results
                        (default: wpsentry_results)
  --db-update           Update the tool and vulnerability databases
  --auto-sync           Automatically sync vulnerability databases before
                        scanning
  --format {console,html,md}
                        Output report format (default: console)

---

Output Structure

A successful scan creates a timestamped output directory:

results_example.com_YYYYMMDD_HHMMSS/
├── scan_results.log          # Step-by-step diagnostic log
├── wp_info.json              # Fingerprint detection metadata
├── vulnerabilities.json      # CVE database match results
├── deep_scan_findings.json   # Active probe findings (60+ checks)
├── exploitation_results.json # Exploit attempt outcomes (--pwn only)
└── report_YYYYMMDD_HHMMSS.html  # Interactive HTML dashboard (--format html)

---

⚠️ Disclaimer

WPSentry is intended strictly for authorized security testing, penetration testing engagements, and educational research.

By using this tool you agree to the following:

1. You have explicit written authorization from the owner of every target system before running any scan or exploit.
2. You accept full legal and ethical responsibility for how this tool is used. Unauthorized scanning, exploitation, or probing of systems you do not own or have permission to test is illegal in most jurisdictions and may result in criminal prosecution.
3. The authors and contributors of WPSentry accept zero liability for any damage, data loss, service disruption, legal consequences, or regulatory violations arising from use of this tool.
4. This tool must not be used to attack production systems without a formal penetration testing agreement, to perform unauthorized reconnaissance, or to facilitate any activity that violates applicable laws.
5. Vulnerability data and CVE references included in this tool are for defensive awareness purposes only.

If you are unsure whether you have permission to test a target — you do not have permission. Do not proceed.

AI-Assisted Development Notice

Several security checks, exploit handlers, and hardening audit modules in this tool were designed and implemented with the assistance of Claude (Anthropic). While these checks are based on publicly documented CVEs, security research, and WordPress hardening best practices, they have not been independently audited by a certified security professional.

• Check logic, CVE references, and payload probes may contain inaccuracies.
• Active exploit modules should be treated as proof-of-concept probes, not production-grade exploit frameworks.
• Always validate findings manually before acting on them in a real engagement.
• Do not solely rely on this tool's output as a definitive security assessment.

---

Credits, Attributions & Project Lineage

Important

This repository is a customized downstream distribution. The core scanning architecture and database schemas are built directly upon the foundation created by @Triotion. All credit for the initialization of this project goes to the original developer.

• Original Author: @Triotion
• Official Telegram Channel: Triotion Telegram Contact
• Original Repository: Triotion/wp-scanner

If you find the base scanning logic valuable, please visit the original repository and leave a star!

---

Detailed Enhancement History (Downstream Modifications)

Below is a detailed breakdown of the structural refactoring, performance improvements, and interface updates added in this enterprise edition:

Feature / Module	Original Codebase (Triotion/wp-scanner)	Refactored Enterprise Edition (This Downstream Repo)
Code Modularity	Monolithic scripts. deep_scanner.py and exploiter.py exceeded 1,000+ lines of code each, making them difficult to maintain.	Strict file-size budget (no file over ~300 lines). Split scanners and exploiters into cohesive sub-packages (modules/checks/ and modules/exploits/).
Pipeline Integration	Required explicit --deep command-line flags. Database vulnerability lookup and active deep scans ran as separate pipelines.	Merged pipelines. Database lookup and active deep checks run by default under a single pipeline for maximum safety auditing.
Mass Scanning	Shared/mutated global argparse.Namespace arguments directly across worker threads, resulting in thread execution race conditions.	Isolated ScanContext instances per target. Fully thread-safe runner class located in modules/mass_scanner.py.
Scan Context	Passed up to 8 variables manually to class initializers (session, headers, timeout, output_dir, threads, etc.).	Unified ScanContext dataclass containing typed attributes for HTTP clients, directories, target variables, and logging streams.
Exploitation Logging	Exploitation output console logs were lost on execution completion and not logged inside output directories.	Exploits are mapped back to their active deep checks and automatically recorded into the unified HTML report database tab.
Report Interface	Standard style rendering template file.	Dark-theme dashboard with interactive search filter inputs, statistics cards, and accordion dropdown displays.

---

License

This project is licensed under the MIT License - see the LICENSE file for details. Original license and copyright terms belong to the original author @Triotion.