wpscanteam/wpscan · error · WPScan::Error::MissingDatabaseFile

Update required, you can not run a scan if a database file i

Error message

Update required, you can not run a scan if a database file is missing.

What it means

Raised by Core#update_db_required? (app/controllers/core.rb:189) when files required by the local vulnerability database are missing from DB_DIR ($XDG_CACHE_HOME/wpscan/db, ~/.cache/wpscan/db, or ~/.wpscan/db) and the run was started with an explicit --no-update (ParsedCli.update == false). WPScan refuses to scan with an incomplete database because finders, fingerprints and vulnerability lookups depend on those files.

Source

Thrown at app/controllers/core.rb:189

      #
      # @param [ String ] effective_url
      # @param [ Addressable::URI ] effective_uri
      def handle_follow_redirect(effective_url, effective_uri)
        return unless WPScan::ParsedCli.follow_redirect && target.url != effective_url

        target.url = effective_url
        target.scope << effective_uri.host
      end

      # @return [ DB::Updater ]
      def local_db
        @local_db ||= DB::Updater.new(DB_DIR)
      end

      # @return [ Boolean ]
      def update_db_required?
        if local_db.missing_files?
          raise Error::MissingDatabaseFile if ParsedCli.update == false

          return true
        end

        return ParsedCli.update unless ParsedCli.update.nil?

        return false unless user_interaction? && local_db.outdated?

        output('@notice', msg: 'It seems like you have not updated the database for some time.')
        print '[?] Do you want to update now? [Y]es [N]o, default: [N]'
        $stdout.flush

        response = $stdin.gets.to_s.strip

        !!/^y/i.match?(response)
      end

      def update_db

View on GitHub (pinned to 62c9cef471)

Solutions

Run `wpscan --update` once to download the missing database files
Remove --no-update from the command so missing files trigger an automatic update before the scan
If the update itself fails, check DB_DIR is writable and the disk is not full, then retry

Example fix

# before
wpscan --url http://target --no-update
# => Update required, you can not run a scan if a database file is missing.

# after
wpscan --update && wpscan --url http://target --no-update

Defensive patterns

Strategy: validation

Validate before calling

# Fail fast in scripts when the local DB is incomplete
updater = WPScan::DB::Updater.new(WPScan::DB_DIR)
system('wpscan --update') if updater.missing_files?
# only now launch the scan with --no-update

Try / catch

begin
  scan.run
rescue WPScan::Error::MissingDatabaseFile
  `wpscan --update`
  retry
end

Prevention

Run wpscan --update during CI image build, not per-scan
Only pass --no-update when a prior successful update is guaranteed
Keep DB_DIR writable and persistent
Treat a failed update as fatal — never continue into a scan with --no-update

When it happens

Trigger: `wpscan --url http://target --no-update` on a machine where the DB was never downloaded (fresh install), was wiped (cleared cache, new XDG dir), or a previous update failed halfway. Explicit --no-update turns missing files into a hard error instead of letting the scan update first.

Common situations: CI/automation scripts that always pass --no-update; first run in a fresh container/image; users who deleted ~/.wpscan or moved between the legacy and XDG cache layouts; disk-full during a previous update.

Related errors

AI-assisted analysis of wpscanteam/wpscan@62c9cef471 (2026-08-21). Data as JSON: /api/errors/0aa14c195a53e8af. Report an issue: GitHub.