Advanced WordPress Plugin Vulnerability Scanner with AI-powered detection, featuring 48 comprehensive security rules and sophisticated pattern matching.
- 48 Detection Rules covering basic to advanced vulnerabilities
- AST-Based Analysis using tree-sitter for accurate PHP parsing
- Taint Analysis with source-sink-sanitizer tracking
- Pattern Matching supporting metavariables and complex logic
- WordPress-Specific intelligence for hooks, REST API, and capabilities
- Multiple Scan Modes - WordPress.org plugins, local files, GitHub repos
- Server Mode for continuous automated scanning
- Rich Reports in JSON, HTML, and CVE-ready Markdown formats
- SQL Injection (traditional & second-order)
- Cross-Site Scripting (reflected & stored)
- Command Injection
- LDAP Injection
- XXE Injection
- GraphQL Injection
- NoSQL/MongoDB Injection
- Email Header Injection
- Template Injection (SSTI)
- IDOR (Insecure Direct Object Reference)
- Privilege Escalation
- Missing Authorization Checks
- Missing CSRF/Nonce Protection
- Type Juggling/Loose Comparison
- Timing Attacks
- JWT Vulnerabilities
- OAuth Flaws
- Session Fixation
- Arbitrary File Upload
- Path Traversal
- Zip Slip
- SSRF (Server-Side Request Forgery)
- Open Redirect
- CORS Misconfiguration
- Cache Poisoning
- HTTP Request Smuggling
- DOM Clobbering
- Race Conditions (TOCTOU)
- ReDoS
- Price/Quantity Manipulation
- Mass Assignment
- Information Disclosure
- Array Pollution
- Weak Algorithms
- Insecure Randomness
- Hardcoded Credentials
pip install PluginHuntergit clone https://github.com/yourusername/PluginHunter.git
cd PluginHunter
pip install -e .- Python 3.8+
- tree-sitter & tree-sitter-php
- All dependencies auto-installed via pip
PluginHunterPluginHunter scan-plugin woocommercePluginHunter scan-local /path/to/pluginPluginHunter scan-github https://github.com/user/pluginPluginHunter scan-zip plugin.zip# Scan a plugin from WordPress.org
PluginHunter scan-plugin contact-form-7
# Output:
# - scan_contact-form-7_TIMESTAMP.json
# - scan_contact-form-7_TIMESTAMP.html
# - scan_contact-form-7_TIMESTAMP_cve.md (if critical/high findings)# Scan with specific output directory
PluginHunter scan-plugin woocommerce --output ./reports
# Scan local directory with deep analysis
PluginHunter scan-local ./my-plugin --deep-scan
# Scan GitHub repo with specific branch
PluginHunter scan-github https://github.com/user/plugin --branch develop# Configure server mode (interactive wizard)
PluginHunter configure-server
# Start server mode
PluginHunter server-mode
# Features:
# - Continuous scanning
# - Cron-based scheduling
# - Discord/Telegram notifications
# - WordPress.org API integration
# - Automated report generation- Scan WordPress.org Plugin (by slug)
- Scan Local ZIP File
- Scan GitHub Repository
- Manage Detection Rules (Unified)
- View Scan History
- Configuration Settings
- Server Mode Configuration
- Start Server Mode
- About PluginHunter
- Exit
- Scan Mode: Continuous or Cron-based
- Notifications: Discord webhooks, Telegram bots
- Targets: Plugin lists, categories, search queries
- Rate Limiting: Configurable delays
- Reports: Per-plugin organized directories
- XSS: 2 rules (reflected, stored)
- SQL Injection: 2 rules (traditional, second-order)
- RCE: 2 rules (dangerous functions, SSTI)
- File Operations: 3 rules (upload, traversal, zip slip)
- Command Injection: 1 rule
- Other Injections: 5 rules (LDAP, XXE, GraphQL, NoSQL, Email)
- SSRF: 1 rule
- Auth/Authz: 12 rules (IDOR, privilege escalation, etc.)
- CSRF: 4 rules (nonce checks, hook protection)
- Crypto: 3 rules (weak algorithms, randomness, credentials)
- Info Disclosure: 2 rules (sensitive data, deserialization)
- Business Logic: 2 rules (price manipulation, mass assignment)
- Web Attacks: 6 rules (redirect, CORS, cache, smuggling, etc.)
- Modern Attacks: 4 rules (JWT, OAuth, timing, race conditions)
40+ CWE categories including:
- CWE-79 (XSS), CWE-89 (SQLi), CWE-94 (Code Injection)
- CWE-200 (Info Exposure), CWE-208 (Timing)
- CWE-269 (Privilege), CWE-338 (Weak PRNG)
- CWE-352 (CSRF), CWE-367 (Race Condition)
- CWE-434 (File Upload), CWE-601 (Open Redirect)
- And many more...
✅ Complete coverage of all OWASP Top 10 2021 categories
{
"scan_id": "abc123",
"plugin_info": {...},
"statistics": {...},
"findings": [
{
"rule_id": "wp-reflected-xss",
"severity": "high",
"line": 42,
"file": "plugin.php",
"message": "...",
"cwe": ["CWE-79"],
"confidence": "HIGH"
}
]
}- Interactive dashboard
- Severity-based filtering
- Code snippets with line numbers
- CWE and OWASP mappings
- Remediation guidance
- Professional vulnerability reports
- CVSS scoring
- Proof of concept
- Remediation steps
- Ready for CVE submission
- AST Parser: PHP code parsing with tree-sitter
- Taint Engine: Data flow analysis
- Pattern Matcher: Semgrep-style pattern matching
- WordPress Analyzer: Hook and REST API analysis
- Rule Loader: YAML-based rule management
- Report Generator: Multi-format output
- Load Rules: 48 YAML rules loaded
- Parse Code: AST generation for PHP files
- Pattern Match: Apply detection patterns
- Taint Analysis: Track data flow
- WordPress Analysis: Check hooks, capabilities, nonces
- Generate Reports: JSON, HTML, CVE formats
- Metavariables:
$VAR,$FUNC,$KEY - Pattern Lists: AND logic for multiple conditions
- Pattern Exclusions:
pattern-not-inside - Regex Validation:
metavariable-regex - Sanitizer Detection: AST tree walking
- Source-sink-sanitizer tracking
- Data flow across scopes
- Variable tracking through assignments
- Context-aware analysis
- Hook registration analysis
- REST API endpoint detection
- Capability check validation
- Nonce verification
- WordPress function awareness
- Quick Start Guide
- Server Mode Guide
- Complete Rule Documentation
- Release Notes
- FAQ
- Contributing Guide
- Security Policy
We welcome contributions! Please see CONTRIBUTING.md for guidelines.
- New detection rules
- Improved pattern matching
- False positive reduction
- Performance optimization
- Documentation improvements
- Sanitizer Detection: Some sanitized code may be flagged (v1.3.1 fix planned)
- Duplicate Findings: Some rules may produce duplicates (v1.3.1 fix planned)
- Variable Tracking: Limited assignment tracking (v1.3.1 enhancement planned)
- Improved sanitizer detection
- Finding deduplication
- Enhanced variable tracking
- Reduced false positives
- API security rules
- Microservice vulnerabilities
- Container security
- Supply chain analysis
- Machine learning integration
- 48 Detection Rules
- 40+ CWE Categories
- 15 Rule Categories
- 8 Severity Levels
- 3 Confidence Levels
- 100% OWASP Top 10 Coverage
- Security Researchers: Find 0-days in WordPress plugins
- Plugin Developers: Secure your code before release
- Security Teams: Automated vulnerability scanning
- Bug Bounty Hunters: Discover vulnerabilities faster
- Penetration Testers: Comprehensive security assessment
MIT License - see LICENSE file for details
LAKSHMIKANTHAN K (letchupkt)
- Email: letchupkt.dev@gmail.com
- GitHub: @letchupkt
- WordPress Security Team
- OWASP Foundation
- Semgrep Community
- Tree-sitter Project
- Issues: GitHub Issues
- Discussions: GitHub Discussions
- Email: letchupkt.dev@gmail.com
This tool is for security research and testing purposes only. Always obtain proper authorization before scanning systems you don't own. The authors are not responsible for misuse of this tool.
Made with ❤️ for WordPress Security