Nightly WPScan WordPress Vulnerability Scan with Email

Nightly WPScan WordPress Vulnerability Scan with Email

Run an automated, nightly WordPress vulnerability inventory: this n8n workflow pulls your installed plugins and themes via the WordPress REST API, checks them against the WPScan vulnerability database (within your API quota), saves scan history, and emails you a plain-text report of any applicable issues.

What this workflow does

• Schedules nightly at 03:30 and starts by validating scan settings (site URL, email recipients/sender, and the per-run WPScan lookup limit).
• Checks your remaining WPScan daily API quota and determines how many components can be looked up.
• Fetches installed plugins and themes from the WordPress REST API, then loads previous check timestamps from an n8n Data Table.
• Selects components to scan based on quota, prioritizing active components and those checked least recently.
• Queries WPScan per selected component and filters vulnerabilities so you only see issues that affect the installed version.
• Upserts results into the wpscan_scan_history Data Table (including last checked time and findings).
• Builds and emails a plain-text report, including items not checked or lookup failures when applicable (sent via SMTP when configured).

Use cases

• Maintain ongoing security visibility for a SaaS-hosted WordPress fleet without manual plugin/theme review.
• Help security and ops teams catch new WPScan-detected vulnerabilities soon after they become discoverable via version checks.
• Track plugin/theme risk over time by storing scan history in wpscan_scan_history and generating consistent email alerts.

Technical details

• Integrations: WordPress REST API (HTTP Basic Auth using an admin Application Password) and WPScan API (token-based).
• Workflow logic & nodes: if, set, code, data table, and email send (plus a sticky note for guidance).
• Data storage: n8n Data Table named wpscan_scan_history with columns component, kind, slug, version, last_checked, findings, and affected_count.