---

📋 Overview

WPRecon is a modern WordPress security reconnaissance tool built with Go that helps security engineers identify vulnerabilities, misconfigurations, and information disclosure issues in WordPress installations.

Unlike traditional vulnerability scanners with hardcoded checks, WPRecon uses a YAML-driven template architecture, enabling:

• ✅ Easy extensibility without recompilation
• ✅ Team collaboration via shared templates
• ✅ Rapid deployment as a single binary
• ✅ High-performance parallel scanning
• ✅ Flexible matching and extraction capabilities

Key Statistics

• Single Binary - No runtime dependencies
• 150+ Templates - Comprehensive WordPress coverage
• Parallel Scanning - Configurable worker pools
• Minimal Code - ~1,200 lines of production code
• Production Ready - Battle-tested architecture

---

⚡ Features

Core Capabilities

Feature	Description
Parallel Scanning	Configurable worker pool (default: 10 workers) for concurrent requests
Rate Limiting	Built-in request throttling (default: 50 req/s) to be network-friendly
Auto Retry	Automatic retry logic for failed HTTP requests
Hot Reload Templates	No recompilation needed - add templates and scan
Variable Resolution	Dynamic variables: {{BaseURL}}, {{Timestamp}}, {{RandomInt}}
Multi-Format Output	Human-readable tables and structured JSON
CLI & API Modes	Both command-line and REST API interfaces
Severity Levels	Findings classified as info, low, medium, high, critical

HTTP Operations

• All standard HTTP methods (GET, POST, PUT, DELETE)
• Custom headers and cookies
• Request body parameters
• SSL/TLS support
• Configurable timeouts

Matchers (5 Types)

Identify positive hits in responses:

1. Status - HTTP status code matching (200, 404, 500, etc.)
2. Word - Substring presence in response body
3. Regex - Pattern matching with capture groups
4. Header - Response header validation
5. Size - Response body size checks

Extractors (2 Types)

Extract actionable data from matched responses:

1. Regex - Extract capture groups using regular expressions
2. JSON - Simple JSON path extraction

Template Library

150+ production-ready templates covering:

• WordPress Detection - Core detection and version fingerprinting
• Plugin Detection - Popular plugin discovery and version detection
• User Enumeration - WordPress user discovery
• CVE Checks - Known vulnerability detection
• Exposures - Information disclosure (backups, .git, .env, etc.)
• WAF Detection - Cloudflare, AWS WAF, ModSecurity, Sucuri, Wordfence
• Security Analysis - Misconfiguration detection and security headers
• Database - Database exposure and repair detection

---

📦 Installation

Requirements

• Go 1.17 or higher
• Linux, macOS, or Windows

From Source

# Clone the repository
git clone https://github.com/ffx64/wprecon.git
cd wprecon

# Build the binary
go build -o wprecon ./cmd/wprecon/main.go

# Move to your PATH (optional)
sudo mv wprecon /usr/local/bin/

Install via Go

go install github.com/ffx64/wprecon/cmd/wprecon@latest

Docker (Optional)

docker build -t wprecon .
docker run wprecon scan https://example.com

---

🚀 Usage

Command-Line Interface

Basic Scan

Scan a WordPress website with all available templates:

wprecon scan https://example.com

Scan with Specific Templates

Run only selected templates:

wprecon scan https://example.com -t wordpress-detection,plugin-detection,user-enumeration

Custom Output Format

# JSON output for automation
wprecon scan https://example.com --output json

# Pretty-printed table (default)
wprecon scan https://example.com --output table

Control Parallelization and Rate Limiting

# Use 20 concurrent workers and 100 requests/sec
wprecon scan https://example.com --workers 20 --rate-limit 100

List Available Templates

wprecon list-templates

Show Help

wprecon --help

---

📋 Example Output

When running a scan, WPRecon produces detailed findings:

Table Format:

ID                    | Template                | Name                      | Severity | Target              | Evidence
---------------------|------------------------|--------------------------|----------|---------------------|----------
finding_001           | wordpress-version      | WordPress Version Found  | info     | example.com         | 6.2.1
finding_002           | plugin-detection       | Plugin Detected          | low      | example.com         | Yoast SEO 16.0
finding_003           | security-headers       | Missing Security Headers | medium   | example.com         | X-Frame-Options

JSON Format:

{
  "scan_id": "scan_uuid_001",
  "timestamp": "2026-04-10T14:37:00Z",
  "target": "https://example.com",
  "total_findings": 15,
  "findings": [
    {
      "id": "finding_uuid_001",
      "template_id": "wordpress-detection",
      "name": "WordPress Installation Detected",
      "description": "WordPress CMS installation identified on target",
      "severity": "info",
      "cvss_score": 0.0,
      "matched_url": "https://example.com/wp-admin/",
      "http_method": "GET",
      "status_code": 200,
      "response_time_ms": 245,
      "evidence": {
        "version": "6.2.1",
        "wp_version_header": "6.2.1"
      },
      "timestamp": "2026-04-10T14:37:00Z",
      "remediation": "Keep WordPress updated to the latest version"
    }
  ]
}

---

🏗️ Architecture

Project Structure

wprecon/
├── cmd/wprecon/
│   └── main.go                    # CLI entrypoint
├── internal/
│   ├── app/
│   │   ├── cli.go                 # CLI command handlers
│   │   └── api.go                 # REST API handlers
│   ├── engine/
│   │   ├── scanner.go             # Scan orchestration
│   │   ├── worker_pool.go         # Parallelization engine
│   │   ├── context.go             # Scan context management
│   │   ├── logger.go              # Logging utilities
│   │   └── rate_limit.go          # Rate limiting
│   ├── executor/
│   │   ├── http_executor.go       # HTTP client
│   │   ├── request_builder.go     # Request construction
│   │   └── variables.go           # Variable resolution
│   ├── matchers/
│   │   └── matchers.go            # Response matching logic
│   ├── extractors/
│   │   └── extractors.go          # Data extraction
│   ├── templates/
│   │   ├── loader.go              # Template discovery
│   │   └── parser.go              # YAML parsing
│   ├── pipeline/
│   │   └── pipeline.go            # Scan workflow
│   └── domain/
│       ├── template.go            # Data models
│       ├── finding.go
│       ├── http.go
│       ├── matcher.go
│       └── extractor.go
├── templates/                      # YAML template library
│   ├── wordpress/                  # WordPress-specific
│   ├── cves/                       # CVE detection
│   ├── exposures/                  # Info disclosure
│   ├── common/                     # Generic checks
│   └── waf/                        # WAF detection
└── go.mod                          # Dependencies

Architecture Diagram