WPScan
WordPress vulnerability and enumeration scanner.
Quick Start
wpscan --url https://target.com
wpscan --url https://target.com --enumerate u,p,t --api-token <TOKEN>
wpscan --url https://target.com -U admin -P /usr/share/wordlists/rockyou.txt
Core Flags
| Flag |
Purpose |
--url <url> |
Target WordPress URL |
--enumerate <items> |
u=users, p=plugins, t=themes, vp=vuln plugins, vt=vuln themes, ap=all plugins, at=all themes, tt=timthumbs, cb=config backups, dbe=db exports, m=media ids |
--api-token <token> |
WPScan API token (required for CVE data) |
--plugins-detection |
aggressive / passive / mixed |
--themes-detection |
aggressive / passive / mixed |
-U <user> |
Username (or file) for brute-force |
-P <wordlist> |
Password wordlist |
--password-attack |
xmlrpc / xmlrpc-multicall / wp-login |
--usernames <list> |
Usernames to brute-force (comma-sep or file) |
--proxy <proxy> |
HTTP proxy (e.g., http://127.0.0.1:8080) |
--cookie <str> |
Cookie for authenticated scans |
--headers <str> |
Custom HTTP headers |
--http-auth <u:p> |
HTTP basic auth |
-o <file> |
Output file |
--format <fmt> |
cli / json / cli-no-colour |
--throttle <ms> |
Milliseconds between requests |
--request-timeout <n> |
Timeout per request |
--connect-timeout <n> |
Connection timeout |
--max-threads <n> |
Max concurrent threads (default 5) |
--wp-content-dir <dir> |
Override wp-content dir if non-standard |
--wp-plugins-dir <dir> |
Override plugins dir |
--disable-tls-checks |
Skip SSL verification |
--ignore-main-redirect |
Don't follow main domain redirect |
--force |
Proceed even if target isn't WordPress |
--update |
Update WPScan database |
-v / --verbose |
Verbose output |
--stealthy |
Passive detection only + random UA |
Enumeration Targets
# Users only (fastest, high value)
wpscan --url https://target.com --enumerate u
# Vulnerable plugins only (most impactful)
wpscan --url https://target.com --enumerate vp --api-token $TOKEN
# Full aggressive enum
wpscan --url https://target.com \
--enumerate ap,at,u,tt,cb,dbe \
--plugins-detection aggressive \
--api-token $TOKEN
# Config backups (wp-config.php.bak, wp-config.php~, etc.)
wpscan --url https://target.com --enumerate cb
# Database exports
wpscan --url https://target.com --enumerate dbe
Password Attacks
# Brute-force via wp-login.php (slower, stealthier)
wpscan --url https://target.com \
--usernames admin \
--passwords /usr/share/wordlists/rockyou.txt \
--password-attack wp-login
# XML-RPC multicall (faster, bypasses rate limiting)
wpscan --url https://target.com \
--usernames admin \
--passwords /usr/share/wordlists/rockyou.txt \
--password-attack xmlrpc-multicall
# Enumerate users first, then attack
wpscan --url https://target.com --enumerate u --api-token $TOKEN -o users.json --format json
cat users.json | jq -r '.users[].username' > found_users.txt
wpscan --url https://target.com -U found_users.txt -P passwords.txt
Authenticated Scanning
# With session cookie (login via browser first)
wpscan --url https://target.com \
--cookie "wordpress_logged_in_xxx=admin%7C..."
# With admin credentials (finds more plugins/themes)
wpscan --url https://target.com \
--enumerate ap \
--username admin --password 'AdminPass123!' \
--plugins-detection aggressive
Common Findings
| Finding |
Impact |
| Outdated plugins with CVEs |
RCE / LFI / SQLi |
| User enumeration via author archive |
Enables password attacks |
| xmlrpc.php enabled |
Brute-force amplification (multicall = 500 tries/request) |
| readme.html / license.txt |
WordPress version disclosure |
| Timthumb vulnerability |
Remote code execution |
Debug log exposed (/wp-content/debug.log) |
Info disclosure, credentials |
Config backup (wp-config.php.bak) |
Database credentials |
| DB export in web root |
Full database dump |
| Registration open |
Account creation → plugin exploit |
Common Workflows
# Quick recon pass
wpscan --url https://target.com --enumerate u,vp,vt \
--api-token $TOKEN -o wp_scan.json --format json
# Parse JSON output for CVEs
cat wp_scan.json | jq '.plugins | to_entries[] | {plugin: .key, vulns: .value.vulnerabilities}'
# Stealthy scan (minimize fingerprint)
wpscan --url https://target.com --stealthy --enumerate u \
--throttle 2000
# Through proxy for manual review
wpscan --url https://target.com --proxy http://127.0.0.1:8080 \
--disable-tls-checks --enumerate u,vp --api-token $TOKEN
Key Attack Paths
1. Enumerate users → brute-force weak passwords → admin access → RCE via theme editor
2. Find vulnerable plugin (CVE) → exploit SQLi/LFI/RCE directly
3. xmlrpc.php enabled → multicall brute-force (bypass account lockout)
4. Config backup found → extract DB creds → wp_users table → crack password hashes
5. Registration enabled + vulnerable plugin → account takeover chain
Resources
| File |
When to load |
references/wordpress-testing.md |
XML-RPC abuse, REST API enum, auth bypass, manual exploitation |
AeonDave