WordPress CVE Scanner

Scan your WordPress core, themes and plugins for known CVEs from the command line. Open source, auditable, privacy-first — powered by the ValtersIT CVE API.

Part of the ValtersIT platform — CVE & Threat-IP data you can query or run yourself. Explore both API and scanners: https://www.valtersit.com/platform/ Scanner plans & pricing: https://www.valtersit.com/cve/pricing/#scanners

What it does

Detects the WordPress core version, every installed theme, and every installed plugin (with exact versions) on the machine you run it on. If WP-CLI is available it also reports which theme is active and which plugins are active vs. merely installed; otherwise it lists everything it can see on disk. It only ever scans a WordPress installation physically present on the local filesystem — pass it a URL and it refuses to run. It then submits that component list to the ValtersIT API and reports back the CVEs that match.

Your data stays yours

• What we receive: component name and version only (e.g. wordpress-core 6.7.1, WordPress Plugin akismet 5.3.3), plus a locally-generated random identifier so repeat scans of the same install are recognised as the same system.
• What we never receive: your server's IP address, hostname, MAC address, encryption keys, passwords, database contents, or the contents of any file. Nothing outside of name + version (+ that random identifier) ever leaves this script.
• What it does not do: no database access (it reads plugin/theme header comments and, optionally, shells out to your own wp CLI — it never opens wp-config.php or connects to MySQL itself), no file uploads, no background phone-home beyond the one scan submission call itself.
• Audit it yourself. This is open source — two files, ~450 lines total. Read valtersit-wp-scan.py and valtersit_client.py; there is nothing else running.

Install

Clone the repository:

# GitHub
git clone https://github.com/hugovalters/wordpress-cve-scanner
cd wordpress-cve-scanner

# GitLab
git clone https://gitlab.com/valtersit/wordpress-cve-scanner
cd wordpress-cve-scanner

Or, one-liner (no git required):

# GitHub
mkdir -p wordpress-cve-scanner && cd wordpress-cve-scanner
curl -fsSLO https://raw.githubusercontent.com/hugovalters/wordpress-cve-scanner/main/valtersit-wp-scan.py
curl -fsSLO https://raw.githubusercontent.com/hugovalters/wordpress-cve-scanner/main/valtersit_client.py

# GitLab
mkdir -p wordpress-cve-scanner && cd wordpress-cve-scanner
curl -fsSLO https://gitlab.com/valtersit/wordpress-cve-scanner/-/raw/main/valtersit-wp-scan.py
curl -fsSLO https://gitlab.com/valtersit/wordpress-cve-scanner/-/raw/main/valtersit_client.py

Set your API key — either method works:

# Method 1: environment variable (recommended)
export VALTERSIT_API_KEY="vit_v1_your_key_here"

# Method 2: edit one line directly in valtersit_client.py
#   API_KEY = "vit_v1_your_key_here"

Get a key at valtersit.com/cve/pricing.

Run it:

python3 valtersit-wp-scan.py --path /var/www/html
# or, if run from inside the WordPress root, --path can be omitted

Requires only a stock Python 3 interpreter (3.7+). No pip install.

Sample output

ValtersIT WordPress Scanner - target: /var/www/html
Detection method: WP-CLI (active/inactive known)

==============================================================================
 WORDPRESS CORE
==============================================================================
Component             Version
-------------------------------------
wordpress-core        6.7.1

 1 item(s) detected. No IP address, hostname, MAC address, file
 contents, or credentials were read or transmitted by this scan.
==============================================================================

==============================================================================
 ACTIVE / INSTALLED THEMES (2)
==============================================================================
Slug                           Version       Status
--------------------------------------------------------
twentytwentyfour               1.2           active
twentytwentythree              1.4           inactive
...

==============================================================================
 INSTALLED PLUGINS (14)
==============================================================================
Slug                               Version       Status
------------------------------------------------------------
akismet                            5.3.3         active
woocommerce                        9.4.1         active
...

[+] Scan submitted. 17 component(s) sent for matching.
{
  "matched_cves": 2,
  "results": [
    {"slug": "woocommerce", "version": "9.4.1", "cve_id": "CVE-2026-31842", "cvss": 8.1, "patched_in": "9.4.3"},
    {"slug": "akismet", "version": "5.3.3", "cve_id": "CVE-2025-90210", "cvss": 5.4, "patched_in": "5.3.4"}
  ]
}

What to do next: cross-reference any cve_id above against https://www.valtersit.com/cve/CVE-XXXX-XXXXX/ for the full write-up (CVSS, EPSS, exploit availability, patch guidance) before deciding what to update first. Anything with a patched_in version newer than what's installed is your priority list.

Schedule it

Cron, daily at 04:00, non-interactive (requires you to have already confirmed the authorised-use prompt once interactively):

0 4 * * * cd /opt/wordpress-cve-scanner && VALTERSIT_API_KEY=vit_v1_xxx /usr/bin/python3 valtersit-wp-scan.py --path /var/www/html --yes >> /var/log/valtersit-wp-scan.log 2>&1

One-liner:

VALTERSIT_API_KEY=vit_v1_xxx python3 valtersit-wp-scan.py --path /var/www/html --yes

Setup paths

Clean new system: install Python 3 (present by default on nearly every Linux distribution) and, optionally, WP-CLI for active/inactive plugin & theme status. Clone this repo, set VALTERSIT_API_KEY, run once interactively to confirm authorised use, then add the cron line above.

Existing production system: nothing needs to change on the WordPress install itself — this tool only reads, it never writes to wp-content, never touches the database, and never restarts anything. Drop the two files anywhere readable by the user that runs it (a low-privilege user is sufficient; it does not need to be www-data or root, only read access to the WordPress directory), export the API key, and run it once by hand before scheduling it.

Authorised use only

Run this tool only against WordPress installations you own, or for which you have explicit written authorisation to assess. This tool intentionally refuses to target anything other than a local filesystem path for exactly this reason — it cannot be pointed at a third-party site over the network.

Before its first scan, this tool shows exactly this and requires you to type YES to continue — no confirmation, no scan:

------------------------------------------------------------------------------
 ValtersIT Scanner — Authorised Use Confirmation
------------------------------------------------------------------------------
 Run this tool ONLY against systems you own, or for which you have explicit
 written authorisation to assess.

 This scan sends only component name + version (plus a random local
 identifier) to the ValtersIT API — no IP address, hostname, or file
 contents. See the Privacy Policy: https://www.valtersit.com/privacy

 Type YES to confirm you are authorised to scan this system and continue.
 Anything else aborts without scanning.
------------------------------------------------------------------------------

See valtersit_client.py (require_consent) for that gate.