G2

Alamgir H.

Senior WordPress Engineer

Information Technology and Services

Mid-Market (51-1000 emp.)

7/28/2026

"A practical security check for WordPress sites carrying years of plugin baggage"

5/5

What do you like best about WPScan?

WPScan CLI Scanner is most useful for us when a WordPress installation has been running long enough that nobody fully trusts the plugin inventory anymore. It does far more than simply report that WordPress is outdated. It can identify the Core version, enumerate plugins and themes, match installed versions against known vulnerabilities, and look for the kinds of leftovers that build up after years of migrations and emergency fixes: public configuration backups, exposed database dumps, accessible error logs, directory listing, user enumeration, and other risky configuration details. Its vulnerability data covers WordPress Core, plugins, and themes, and the findings may include references, fixed versions, CVEs, vulnerability types, and proof-of-concept information. That extra context helps us distinguish between a plugin that’s merely old and one where the installed version has a documented issue we need to address before touching production. Version 4 also made plugin discovery more deliberate. A standard scan no longer tries to identify every installed plugin automatically, so when we need a full inventory review, we explicitly enable the relevant enumeration options. I prefer that behavior because it makes the scan’s scope clearer. A quick command shouldn’t give the team false confidence that a deep audit happened in the background. Review collected by and hosted on G2.com.

What do you dislike about WPScan?

I haven’t run into any major issues that would make me stop using WPScan, but you do need to be clear on exactly what it does—and what it doesn’t do. Review collected by and hosted on G2.com.

What problems is WPScan solving and how is that benefiting you?

A WooCommerce store needed a PHP and WordPress upgrade within a tight maintenance window, but the installation had more than thirty plugins, and several hadn’t been updated in months. We ran WPScan CLI against staging with explicit plugin and theme enumeration, authenticated using a WPScan Vulnerability Database API token, and exported the results as SARIF so the findings could be reviewed alongside the repository work. The scan flagged a form plugin with a vulnerability that was fixed in the next release, an abandoned component with no patch available, and a configuration backup that was still publicly accessible inside a directory left behind from an earlier migration. The first run also returned enough 403 responses to make the inventory unreliable, because the hosting security layer was blocking part of the enumeration. Instead of treating that incomplete output as definitive, we arranged an authorized testing window, reran the scan, and confirmed the installed versions from the WordPress admin before finalizing the change plan. We upgraded the plugin that had a fix available, replaced the abandoned component, removed the exposed backup, and documented why another finding didn’t apply under the site’s configuration. WPScan surfaced a file the admin panel would never have shown, and it helped us prioritize based on actual risk rather than blindly updating every outdated plugin while production was already offline. Review collected by and hosted on G2.com.