Wpscan Integration with DefectDojo

Wpscan Integration with DefectDojo

WPScan is a black box security scanner for WordPress sites, developed by the WPScan team and owned by Automattic since 2021. It fingerprints a site's WordPress version, plugins, and themes from the outside, checks them against the WPScan vulnerability database, and reports configuration exposures such as readable files, directory listings, and enabled XML-RPC. Vulnerability data requires a WPScan API token. The command line scanner writes CLI or JSON output, and DefectDojo imports the JSON.

Wpscan Integration with DefectDojo

We run WPScan against every WordPress site we host, because marketing sites and blogs tend to collect plugins faster than anyone updates them. Bringing WPScan results into DefectDojo means each vulnerable plugin becomes a Finding on the Asset for that site, with the CVE, the version that fixes it, and an owner. When the plugin is updated, the next reimport closes the Finding, and the record shows when it happened. WordPress sites stop being a blind spot next to the applications our engineering teams own.

Why Wpscan Matters

WordPress powers a large share of public websites, and most of its security problems come from plugins rather than the core.

• WPScan identifies plugin and core versions without credentials, the same way an attacker would.
• Its vulnerability database is specific to the WordPress ecosystem, with references and fixed-in versions for each entry.
• Interesting findings surface exposures that are not tied to a CVE, such as XML-RPC being enabled or debug files left on the server.
• Sites are often owned by marketing or agencies rather than engineering, so results need to land somewhere with clear ownership and deadlines.

Advantages of This Integration

What we gained by sending WPScan results through DefectDojo:

• Fixed-in versions as mitigation. When WPScan knows the fixed version, it is written to Mitigation and the Finding is flagged as having a fix available.
• Plugin-level components. Plugin vulnerabilities record the plugin slug as the component name and the detected version as the component version, which supports component reporting across sites.
• CVE tracking. CVE references are stored as vulnerability IDs, so DefectDojo can find every site exposed to a specific plugin CVE.
• Scanner confidence. WPScan's detection confidence is carried into DefectDojo's scanner confidence field, which helps separate certain version detections from guesses.
• Reimport lifecycle. Reimporting a new scan into the same Test mitigates vulnerabilities that disappeared after an update.

How This Integration Works

DefectDojo imports WPScan results with the Wpscan scan type, which reads the JSON report.

1. Produce a JSON report. Run WPScan with your API token so vulnerability data is included, and write JSON to a file:

wpscan --url https://blog.example.com \
  --api-token "$WPSCAN_API_TOKEN" \
  --enumerate vp \
  --format json \
  --output wpscan-report.json

--enumerate vp checks for vulnerable plugins. Without an API token, the report contains version and interesting findings but no vulnerability entries.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Wpscan, and upload the file. For automation, use the import API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Wpscan" \
  -F "file=@wpscan-report.json" \
  -F "product_name=corporate-blog" \
  -F "engagement_name=WordPress Monitoring" \
  -F "auto_create_context=true"

DefectDojo Pro users can use Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Wpscan" \
  --report-path "./wpscan-report.json" \
  --product-name "corporate-blog" \
  --engagement-name "WordPress Monitoring" \
  --auto-create-context

3. Reimport on a schedule. Send later scans to /api/v2/reimport-scan/ against the same Test for each site, so updated plugins close their Findings.

Data Granularity: What Gets Imported

The parser reads plugin vulnerabilities, core version vulnerabilities, and interesting findings. Theme results (main_theme, themes) and config backup results in the report are not imported.

Use Cases

For a portfolio of WordPress sites: An agency or web team scans every site weekly and reimports each into a Test per site. DefectDojo shows which sites run vulnerable plugins and which updates are overdue against SLA.

After a plugin vulnerability is disclosed: When a widely used plugin publishes a CVE, a search on that vulnerability ID in DefectDojo lists every site where WPScan found it.

For marketing-owned sites: Findings are assigned to the site owner and pushed to Jira, so a team outside engineering gets clear work items rather than a scanner report.

Alongside application testing: WordPress Findings sit next to DAST and infrastructure results for the same domain, giving a fuller picture of the public web presence.

Operational Tips

• Re-rate important Findings. Every plugin and core vulnerability imports as Medium regardless of its real impact, so review severities after the first import, especially for unauthenticated remote issues, before relying on SLA reports.
• Review theme results in the WPScan output itself. The parser does not import theme vulnerabilities, so a vulnerable theme will not appear in DefectDojo even if WPScan reports it.
• Interesting findings arrive as Info with an endpoint URL. Set minimum_severity=Low if you only want CVE-backed vulnerabilities, or keep them to track exposed files and XML-RPC.
• Keep the API token out of shell history and scripts by passing it through an environment variable or a WPScan configuration file.
• Use one Test per site and reimport into it, so plugin updates close Findings instead of leaving a new Test every week.
• Because the hash includes the description, which contains the plugin location, moving a site to a new path will make existing Findings look new. Close the old ones once after a migration.