{"id":15110013,"url":"https://github.com/automattic/wpscan-vulnerability-test-bench","last_synced_at":"2025-10-19T19:30:18.751Z","repository":{"id":203126964,"uuid":"528575563","full_name":"Automattic/wpscan-vulnerability-test-bench","owner":"Automattic","description":"Standardised setup for researching WordPress plugin- and theme vulnerabilities.","archived":false,"fork":false,"pushed_at":"2023-11-16T16:49:48.000Z","size":28,"stargazers_count":19,"open_issues_count":0,"forks_count":6,"subscribers_count":5,"default_branch":"main","last_synced_at":"2024-10-07T11:19:05.241Z","etag":null,"topics":["ddev","docker","vulnerability-assessment","vulnerability-research","wordpress"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Automattic.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2022-08-24T19:59:35.000Z","updated_at":"2024-10-02T11:01:09.000Z","dependencies_parsed_at":null,"dependency_job_id":"5238bda9-d1e2-429d-876e-32589a806464","html_url":"https://github.com/Automattic/wpscan-vulnerability-test-bench","commit_stats":null,"previous_names":["automattic/wpscan-vulnerability-test-bench"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Automattic%2Fwpscan-vulnerability-test-bench","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Automattic%2Fwpscan-vulnerability-test-bench/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Automattic%2Fwpscan-vulnerability-test-bench/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Automattic%2Fwpscan-vulnerability-test-bench/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Automattic","download_url":"https://codeload.github.com/Automattic/wpscan-vulnerability-test-bench/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":219869272,"owners_count":16555575,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ddev","docker","vulnerability-assessment","vulnerability-research","wordpress"],"created_at":"2024-09-25T23:40:16.428Z","updated_at":"2025-10-19T19:30:18.245Z","avatar_url":"https://github.com/Automattic.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# WPScan Vulnerability Testbench\n\nA DDEV/docker based environment for exploring and replicating vulnerabilities\nin WordPress plugins and themes.\n\n## Up and running\n\nSee the [DDEV installation instructions](https://ddev.readthedocs.io/en/stable/users/install/)\nfor how to install and set up docker and DDEV on your system.\n\nClone this repo:\n```\n$ git clone \u003crepo-url\u003e [\u003ctest-site-root\u003e]\n```\n\nEnter the test site directory and launch it:\n```\n$ cd \u003ctest-site-root\u003e\n$ ddev start\n$ ddev launch wp-admin/\n```\n\nThis should open the test site in your web browser, where you can install the\nplugin/theme you want to test as normal.\n\n## Why?\n\nWhen evaluating potential vulnerabilities reported to WPScan, we see a number\nof common issues that makes it difficult to verify the reported vulnerability.\n\nSometimes this is because the environment where the reported originally reproduced\nthe issue is configured in a specific way. Also we do get a number of reported\nissues that does not properly consider the WordPress security model, like\nusers with Administrator or Editor privileges being allowed to inject HTML\nand Javascript in places where it would normally not make sense to do so.\n\nTo adress both of these issues, we decided we should try to supply a standardised\nenvironment so that issues can be reproduced reliably and in a known environment.\n\n## Standard setup\n\nThis DDEV environment will by default set up WordPress in a multisite configuration with one site\nat the root of the domain. It will create the following users:\n\n| Username | Description |\n|----------|-------------|\n| superadmin | The superadmin with access to the full network |\n| simpleadmin| Admin for the base site |\n| editor     | User with Editor role for the base site |\n| author     | User with Author role for the base site |\n| contributor| User with Contributor role for the base site |\n| subscriber | User with Subscriber role for the base site |\n\nThe password for all users is `password`.\n\n## Other useful commands\n\n### Stop the site:\n\n```\n$ ddev stop\n```\n\n### Completely remove the site:\n\n```\n$ ddev delete --omit-snapshot\n```\n\nNote: this removes the containers completely, but does no changes to the file system.\nThe `--omit-snapshots` flag is to not store a database dump of the db when deleting the site.\n\n### Check aggregated server logs\n\n```\n$ ddev logs\n```\n\n### Run WPCli\n\n```\n$ ddev wp \u003ccommand\u003e ...\n```\n\nFor example:\n```\n$ ddev wp plugin install woocommerce --activate-network\n```\n\nTo install the WooCommerce plugin and activate it on all sites of the network.\n\n### Get help\n\n```\n$ ddev help\n```\n\n## License\n\n```\nWPScan Vulnerability Test Bench\nCopyright (C) 2023  Automattic, Inc\n\nThis program is free software; you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation; either version 2 of the License, or\n(at your option) any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\nLICENSE file in the root of the repo for details.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fautomattic%2Fwpscan-vulnerability-test-bench","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fautomattic%2Fwpscan-vulnerability-test-bench","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fautomattic%2Fwpscan-vulnerability-test-bench/lists"}