wpscanteam/wpscan · error · WPScan::Error::MissingEnterpriseDatabaseFile

Missing enterprise database dump(s): #{files.join(', ')}. Ru

Error message

Missing enterprise database dump(s): #{files.join(', ')}. Run without --no-update so they can be downloaded from enterprise-data.wpscan.org, and check that your --enterprise-db-token is valid.

What it means

Raised by VulnApi#setup_enterprise_db (app/controllers/vuln_api.rb:94) when --enterprise-db-token (or WPSCAN_ENTERPRISE_DB_TOKEN) selects local-dump mode but some files listed in DB::VulnApi::ENTERPRISE_DB_FILES are absent from DB_DIR. Core's DB update normally downloads the dumps from enterprise-data.wpscan.org before the VulnApi controller runs, so missing files mean that update was skipped or failed.

Source

Thrown at app/controllers/vuln_api.rb:94

      # @return [ String, nil ] The enterprise DB token (CLI or ENV)
      def enterprise_db_token
        self.class.enterprise_db_token
      end

      # @return [ String, nil ] The API token (CLI or ENV var)
      def api_token
        self.class.api_token
      end

      # Switches DB::VulnApi to local-dump mode and ensures the dumps are present. Core's DB
      # update normally downloads them before this controller runs (VulnApi is chained after Core).
      def setup_enterprise_db
        DB::VulnApi.local_db = true

        missing = DB::VulnApi::ENTERPRISE_DB_FILES.values.reject { |file| File.exist?(DB_DIR.join(file)) }

        raise Error::MissingEnterpriseDatabaseFile, missing unless missing.empty?
      end
    end
  end
end

View on GitHub (pinned to 62c9cef471)

Solutions

Re-run without --no-update (or run wpscan --update --enterprise-db-token TOKEN) so the dumps are downloaded
Verify the enterprise token is valid — an invalid token fails the download and leaves the files missing
Check DB_DIR is writable with enough free space, then retry the update

Example fix

# before
wpscan --url http://t --enterprise-db-token TOK --no-update
# => Missing enterprise database dump(s): ...

# after
wpscan --url http://t --enterprise-db-token TOK

Defensive patterns

Strategy: validation

Validate before calling

# Verify all enterprise dumps exist before scanning
missing = WPScan::DB::VulnApi::ENTERPRISE_DB_FILES.values.reject { |f| File.exist?(WPScan::DB_DIR.join(f)) }
system('wpscan', '--update', "--enterprise-db-token=#{token}") unless missing.empty?

Try / catch

begin
  scan.run
rescue WPScan::Error::MissingEnterpriseDatabaseFile => e
  run_update; retry # ensure e.files is empty before retrying
end

Prevention

Run the DB update in the CI image build with the enterprise token present
Never pair --enterprise-db-token with --no-update unless dumps are verified cached
Treat failed enterprise downloads as fatal, not skippable
Monitor DB_DIR free space — the enterprise dumps are large

When it happens

Trigger: Running with --enterprise-db-token and --no-update before any successful enterprise download; a previous update that failed (invalid token rejected by the download endpoint, network error); a wiped or relocated cache directory; chaining VulnApi without Core's update step.

Common situations: CI images caching the DB but built without the enterprise token; --no-update habits carried over from API-token workflows; expired/invalid enterprise token causing failed downloads; disk-full preventing the (large) dumps from being written.

Related errors

AI-assisted analysis of wpscanteam/wpscan@62c9cef471 (2026-08-21). Data as JSON: /api/errors/d773e46bb78216d4. Report an issue: GitHub.