wpscanteam / wpscan / 32351909363

95%

push

github

Run the CLI integration tests with a free API token too (#2081)

The integration test only scanned the demo site with the enterprise API token, so
plan specific API regressions were invisible to CI: free plan tokens lost access
to the v4 plugin/theme endpoints in #2079 and it took a user report to surface it.

Scan the same site a second time with a free plan token, and assert the plan each
run actually resolved to so the two runs cannot silently collapse into one.

Both runs now pre-flight their token against the API status endpoint, which costs
no quota (WPScan itself calls it at the start and end of every scan) and fails
with an explicit message when the token is rejected or short on quota. Without it
an exhausted token either aborts with a bare exit code 4, or, when it runs out
mid scan, has its 429s swallowed into empty vulnerability data by DB::VulnApi.get
and looks identical to a detection regression.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

2120 of 2617 branches covered (81.01%)

4729 of 4976 relevant lines covered (95.04%)

17247.41 hits per line