valtersit/wordpress-cve-scannerScan your WordPress core, themes and plugins for known CVEs from the command line. Open source, auditable, privacy-first — powered by the ValtersIT CVE API.
Scan your WordPress core, themes and plugins for known CVEs from the command line. Open source, auditable, privacy-first — powered by the ValtersIT CVE API.
Part of the ValtersIT platform — CVE & Threat-IP data you can query or run yourself. Explore both API and scanners: https://www.valtersit.com/platform/ Scanner plans & pricing: https://www.valtersit.com/cve/pricing/#scanners
Detects the WordPress core version, every installed theme, and every installed plugin (with exact versions) on the machine you run it on. If WP-CLI is available it also reports which theme is active and which plugins are active vs. merely installed; otherwise it lists everything it can see on disk. It only ever scans a WordPress installation physically present on the local filesystem — pass it a URL and it refuses to run. It then submits that component list to the ValtersIT API and reports back the CVEs that match.
wordpress-core 6.7.1, WordPress Plugin akismet 5.3.3), plus a locally-generated random
identifier so repeat scans of the same install are recognised as the same
system.name + version (+ that random identifier)
ever leaves this script.wp CLI — it never opens
wp-config.php or connects to MySQL itself), no file uploads, no
background phone-home beyond the one scan submission call itself.valtersit-wp-scan.py and valtersit_client.py; there is nothing
else running.Clone the repository:
# GitHub
git clone https://github.com/hugovalters/wordpress-cve-scanner
cd wordpress-cve-scanner
# GitLab
git clone https://gitlab.com/valtersit/wordpress-cve-scanner
cd wordpress-cve-scanner
Or, one-liner (no git required):
# GitHub
mkdir -p wordpress-cve-scanner && cd wordpress-cve-scanner
curl -fsSLO https://raw.githubusercontent.com/hugovalters/wordpress-cve-scanner/main/valtersit-wp-scan.py
curl -fsSLO https://raw.githubusercontent.com/hugovalters/wordpress-cve-scanner/main/valtersit_client.py
# GitLab
mkdir -p wordpress-cve-scanner && cd wordpress-cve-scanner
curl -fsSLO https://gitlab.com/valtersit/wordpress-cve-scanner/-/raw/main/valtersit-wp-scan.py
curl -fsSLO https://gitlab.com/valtersit/wordpress-cve-scanner/-/raw/main/valtersit_client.py
Set your API key — either method works:
# Method 1: environment variable (recommended)
export VALTERSIT_API_KEY="vit_v1_your_key_here"
# Method 2: edit one line directly in valtersit_client.py
# API_KEY = "vit_v1_your_key_here"
Get a key at valtersit.com/cve/pricing.
Run it:
python3 valtersit-wp-scan.py --path /var/www/html
# or, if run from inside the WordPress root, --path can be omitted
Requires only a stock Python 3 interpreter (3.7+). No pip install.
ValtersIT WordPress Scanner - target: /var/www/html
Detection method: WP-CLI (active/inactive known)
==============================================================================
WORDPRESS CORE
==============================================================================
Component Version
-------------------------------------
wordpress-core 6.7.1
1 item(s) detected. No IP address, hostname, MAC address, file
contents, or credentials were read or transmitted by this scan.
==============================================================================
==============================================================================
ACTIVE / INSTALLED THEMES (2)
==============================================================================
Slug Version Status
--------------------------------------------------------
twentytwentyfour 1.2 active
twentytwentythree 1.4 inactive
...
==============================================================================
INSTALLED PLUGINS (14)
==============================================================================
Slug Version Status
------------------------------------------------------------
akismet 5.3.3 active
woocommerce 9.4.1 active
...
[+] Scan submitted. 17 component(s) sent for matching.
{
"matched_cves": 2,
"results": [
{"slug": "woocommerce", "version": "9.4.1", "cve_id": "CVE-2026-31842", "cvss": 8.1, "patched_in": "9.4.3"},
{"slug": "akismet", "version": "5.3.3", "cve_id": "CVE-2025-90210", "cvss": 5.4, "patched_in": "5.3.4"}
]
}
What to do next: cross-reference any cve_id above against
https://www.valtersit.com/cve/CVE-XXXX-XXXXX/ for the full write-up (CVSS,
EPSS, exploit availability, patch guidance) before deciding what to update
first. Anything with a patched_in version newer than what's installed is
your priority list.
Cron, daily at 04:00, non-interactive (requires you to have already confirmed the authorised-use prompt once interactively):
0 4 * * * cd /opt/wordpress-cve-scanner && VALTERSIT_API_KEY=vit_v1_xxx /usr/bin/python3 valtersit-wp-scan.py --path /var/www/html --yes >> /var/log/valtersit-wp-scan.log 2>&1
One-liner:
VALTERSIT_API_KEY=vit_v1_xxx python3 valtersit-wp-scan.py --path /var/www/html --yes
Clean new system: install Python 3 (present by default on nearly every
Linux distribution) and, optionally, WP-CLI
for active/inactive plugin & theme status. Clone this repo, set
VALTERSIT_API_KEY, run once interactively to confirm authorised use, then
add the cron line above.
Existing production system: nothing needs to change on the WordPress
install itself — this tool only reads, it never writes to wp-content, never
touches the database, and never restarts anything. Drop the two files
anywhere readable by the user that runs it (a low-privilege user is
sufficient; it does not need to be www-data or root, only read access to
the WordPress directory), export the API key, and run it once by hand before
scheduling it.
Run this tool only against WordPress installations you own, or for which you have explicit written authorisation to assess. This tool intentionally refuses to target anything other than a local filesystem path for exactly this reason — it cannot be pointed at a third-party site over the network.
Before its first scan, this tool shows exactly this and requires you to type
YES to continue — no confirmation, no scan:
------------------------------------------------------------------------------
ValtersIT Scanner — Authorised Use Confirmation
------------------------------------------------------------------------------
Run this tool ONLY against systems you own, or for which you have explicit
written authorisation to assess.
This scan sends only component name + version (plus a random local
identifier) to the ValtersIT API — no IP address, hostname, or file
contents. See the Privacy Policy: https://www.valtersit.com/privacy
Type YES to confirm you are authorised to scan this system and continue.
Anything else aborts without scanning.
------------------------------------------------------------------------------
See valtersit_client.py (require_consent) for that gate.