PwnPress CLI

PwnPress CLI is a Java 21 command line framework for authorized WordPress security assessment. It detects WordPress targets, enumerates exposed metadata, identifies core/plugin/theme versions, and correlates findings with the Wordfence Intelligence vulnerability feed.

Use PwnPress only against systems you own or are explicitly authorized to test.

Contents

• Capabilities
• Requirements
• Installation
• Wordfence API key
• Usage
• Plugin inventory output
• Automation
• Interactive framework
• Documentation
• Development
• Contributing and security

Capabilities

• WordPress target validation for single hosts and target files
• WordPress core version detection and status checks
• Plugin and theme discovery from page source, readme files, and optional wordlists
• Plugin inventory output with installed version, latest wordpress.org version, local plugin path, and wordpress.org plugin page
• Vulnerability matching for WordPress core, plugins, and themes using Wordfence Intelligence
• JSON output for automation, MCP servers, pipelines, and external tooling
• Configurable HTTP timeouts, retries, proxy mode, scan threads, and Wordfence feed selection
• Interactive sections for scanner, target validation, scraping, bruteforce, phisher, pingbacker, and exploit helper workflows

Requirements

• Java 21 runtime
• Network access to target sites
• A Wordfence Intelligence API key for fresh vulnerability feed downloads

The scanner uses a local Wordfence cache to avoid unnecessary API requests. Current Wordfence usage limits still apply when refreshing the cache.

Installation

Debian or Kali

Debian packaging metadata is included under debian/.

sudo apt install openjdk-21-jre-headless
sudo dpkg -i pwnpress_1_4_1_cli.deb
pwnpress --help

Standalone JAR

java -jar pwnpress_1_4_1_cli.jar --help

Windows

Download the release archive, extract it, and run the included executable or JAR with Java 21.

Wordfence API key

Wordfence Intelligence v3 requires authenticated requests:

Authorization: Bearer <api-key>

Configure the key once in interactive settings:

pwnpress
settings
set wordfence api-key <your-wordfence-api-key>

PwnPress stores user settings outside the installation directory so they survive package upgrades:

• Windows: %APPDATA%\PwnPress\settings.properties
• macOS: ~/Library/Application Support/PwnPress/settings.properties
• Linux: ${XDG_CONFIG_HOME}/pwnpress/settings.properties or ~/.config/pwnpress/settings.properties

For CI or one-off runs, use an environment variable instead:

PWNPRESS_WORDFENCE_API_KEY=<your-wordfence-api-key> pwnpress -u example.com

The environment variable takes precedence over the stored value.

Usage

Run a text scan:

pwnpress -u example.com

Run a scan and emit JSON:

pwnpress -u example.com --output json

Write JSON output to a file:

pwnpress -u example.com --output json --output-file report.json

Suppress detailed text output:

pwnpress -u example.com --quiet --no-color

Validate a target or file of targets:

pwnpress --validate example.com
pwnpress --validate targets.txt

Show help:

pwnpress --help

Plugin inventory output

Plugin findings include the installed version, the latest version available from wordpress.org, the discovered plugin location, and the public plugin page:

[+] complianz-gdpr: installed 6.4.2 - latest: 7.4.2
 |-- Location: https://page.com/wp-content/plugins/complianz-gdpr
 `-- Plugin: https://wordpress.org/plugins/complianz-gdpr/

The same fields are included in JSON output under plugins[]:

{
  "slug": "complianz-gdpr",
  "installed_version": "6.4.2",
  "latest_version": "7.4.2",
  "location": "https://page.com/wp-content/plugins/complianz-gdpr",
  "plugin_page": "https://wordpress.org/plugins/complianz-gdpr/"
}

Automation

PwnPress uses stable process exit codes:

Code	Meaning
0	Scan completed and no vulnerabilities were found
1	Scan completed and vulnerabilities were found
2	CLI usage error
3	Runtime or internal error
4	Target is not WordPress

JSON output has schema_version: 1. Additive fields may be introduced without a schema bump. Breaking changes require a new schema version.

Sample outputs are available in examples/json.

Interactive framework

Start interactive mode:

pwnpress

Main sections:

• scanner: run WordPress scans
• target: validate targets and inspect WordPress version status
• settings: configure runtime behavior
• scraper: recursively scrape open directories
• bruteforce: authorized XML-RPC and directory bruteforce helpers
• phisher: phishing page generation utilities for authorized training/testing workflows
• pingbacker: XML-RPC pingback research helpers
• exploit: exploit catalog and custom request helpers

Type help inside any section to see available commands.

Documentation

• Configuration
• Scanner behavior and output
• Development guide

Development

Build and test locally:

mvn clean test

Package the shaded CLI JAR:

mvn clean package

CI runs mvn -B -ntp clean test on pull requests and pushes to main.

Contributing and security

• Contributing guide
• Security policy

License

PwnPress CLI is distributed under GPLv3. See LICENSE.txt.