---

Table of Contents

• What is Plecost?
• Plecost vs WPScan
• Quick Start
• Installation
• CVE Database
• CVE Detection Engine
• Scanning
• Detection Modules
• WooCommerce Security
• WP eCommerce Security
• Output Formats
• Library Usage
• Environment Variables
• Architecture
• Troubleshooting
• Local Test Environment
• License

---

What is Plecost?

Plecost detects vulnerabilities in WordPress installations — core, plugins, and themes — and correlates findings against a daily-updated local CVE database. It runs as a CLI tool, a Python library, or inside task queues like Celery, with a consistent and automation-friendly output format.

No Ruby. No API key. No subscription. No data sent to third parties on every scan.

Plecost vs WPScan

Plecost was built from scratch to fix the limitations teams hit in production when using WPScan: API rate caps, external data dependencies, no library API, no async architecture, and a narrow detection surface.

At a Glance

Capability	Plecost v4	WPScan
Language / runtime	Python 3.11+	Ruby
Async concurrent scanning	✅ httpx + asyncio	❌
Python library API	✅ from plecost import Scanner	❌
API key required	❌ never	⚠️ required for CVE data
CVE data — free tier limit	✅ unlimited (local DB)	❌ 25 API tokens/day
Offline scanning (CVEs included)	✅	❌
Data sent to third parties on scan	❌ none	⚠️ every request
Docker native	✅	✅
Celery / task queue compatible	✅	❌
PostgreSQL support (shared team)	✅	❌

Scanning Capabilities

Capability	Plecost v4	WPScan
Fast mode (top 150 plugins / 50 themes)	✅	❌
Deep mode (4,750+ plugins / 900+ themes)	✅	✅
Configurable concurrency (10–50 requests)	✅	✅
Stealth mode (random UA + passive only)	✅	✅
Aggressive mode (50 parallel requests)	✅	✅
Authenticated scans	✅	✅
Proxy support (HTTP + SOCKS5)	✅	✅
Bulk scan (multiple URLs from file)	✅	❌
Pre-flight 403 detection (aborts cleanly)	✅	❌
Per-module options (--module-option)	✅	❌
Run / skip individual modules	✅	✅
Selective module list (--modules)	✅	❌
Auto-retry with SSL verification disabled	✅	❌

Vulnerability Detection

Capability	Plecost v4	WPScan
WordPress core fingerprinting	✅ (meta, readme, RSS, wp-login)	✅
Plugin detection — passive HTML	✅	✅
Plugin detection — active wordlist	✅ 4,750+ slugs	✅
Theme detection — passive HTML	✅	✅
Theme detection — active wordlist	✅ 900+ themes	✅
CVE correlation (core + plugins + themes)	✅ local DB, daily NVD sync, <5% FP rate	✅ API
Exploit availability flag per CVE	✅	✅
CVSS scores per finding	✅	✅
WAF / CDN detection	✅ 7 providers	⚠️ limited
User enumeration — REST API	✅	✅
User enumeration — author archives	✅	✅
XML-RPC — access, pingback DoS, method list	✅ 3 checks	⚠️ basic
REST API — disclosure, oEmbed, CORS	✅ 3 checks	❌
HTTP security headers	✅ 8 checks (HSTS, CSP, X-Frame…)	❌
SSL / TLS misconfiguration	✅ 3 checks	❌
Misconfiguration (wp-config, .env, .git…)	✅ 12 checks	⚠️ partial
Directory listing (wp-content subdirs)	✅	❌
Debug mode / PHP version disclosure	✅	❌
Open user registration	✅	❌
Content / card skimmer analysis	✅ scripts, iframes, hardcoded keys	❌
Webshell detection	✅ 147–523 paths	❌
Malicious upload detection (PHP in uploads)	✅	❌
WooCommerce dedicated module	✅ 22 checks	❌
WP eCommerce dedicated module	✅ 22 checks	❌
Semi-active eCommerce CVE probes	✅ boolean-only, no time-based	❌
WooCommerce REST API auth bypass	✅ CVE-2023-28121	❌
WooCommerce IDOR / PII disclosure	✅ CVE-2023-34000	❌

Output and Integration

Capability	Plecost v4	WPScan
Rich terminal output (color-coded)	✅	✅
JSON output (stable schema)	✅	✅
Verbose real-time progress (-v)	✅	✅
Quiet mode (HIGH + CRITICAL only)	✅	❌
Stable permanent finding IDs	✅ 120 IDs (PC-MOD-NNN)	❌
plecost explain <ID> — per-finding remediation	✅	❌
Safe to track findings in JIRA / ticketing	✅ IDs never change	❌
Remediation ID per finding (REM-MOD-NNN)	✅	❌
i18n / multilingual output	✅ EN + ES	❌
Included vulnerable test environment (DVWP)	✅ Docker Compose	❌

Data Independence

WPScan sends every scan to wpscan.com to look up CVE data. On the free tier you get 25 API tokens per day — enough for a handful of targets. Plecost keeps the entire CVE database locally, updated daily via GitHub Actions with no per-scan network call to any third-party API.

	Plecost v4	WPScan
Local CVE database (SQLite / PostgreSQL)	✅	❌
Data sent externally on each scan	❌ none	✅ to wpscan.com
CVE updates mechanism	GitHub Actions, NVD API v2	SaaS subscription
Daily incremental patch download	✅ (< 100 KB/day)	—
First-run full database download	✅ plecost update-db	—
Works fully air-gapped after DB download	✅	❌
SHA256 integrity check before download	✅	❌

Quick Start

pip install plecost

# Download the CVE database (first time only — takes a few seconds)
plecost update-db

# Scan a target
plecost scan https://target.wordpress.com

That's it. No account, no API key, no daemon running in the background.

Installation

pip

pip install plecost
pip install plecost[fast]      # adds uvloop for higher throughput
pip install plecost[postgres]  # adds asyncpg for PostgreSQL support

Docker

docker run --rm ghcr.io/plecost/plecost scan https://target.com

# Save JSON report to local directory
docker run --rm -v $(pwd):/data ghcr.io/plecost/plecost scan https://target.com \
  --output /data/report.json

From source

git clone https://github.com/Plecost/plecost.git
cd plecost
pip install -e ".[dev]"

CVE Database

Plecost ships with a local SQLite database covering WordPress core, plugins, and themes. It lives at ~/.plecost/db/plecost.db and is never sent to any external service during scans.

The database needs to be downloaded once before the first scan, and kept up to date thereafter.

First-time setup

plecost update-db

This downloads a pre-built snapshot from plecost-db releases (~10–50 MB). Subsequent runs only download the daily diff — typically under 100 KB.