WPScan

WordPress enumeration — users, plugins, themes & known vulns

WPScan Cheat Sheet

WPScan is a WordPress security scanner that fingerprints core/plugin/theme versions, flags known vulnerabilities (via the WPScan vulnerability database), enumerates users, and brute-forces logins. For authorized testing only.

1. Basic usage

wpscan --url https://target.com
wpscan --url https://target.com --random-user-agent
wpscan --url https://target.com --disable-tls-checks    # self-signed labs

2. The API token (for vulnerability data)

# Get a free token at wpscan.com, then:
wpscan --url https://target.com --api-token YOUR_TOKEN

Without a token WPScan still enumerates, but it won't show CVE/known-vuln data. Store it in ~/.wpscan/scan.yml to avoid passing it each time:

cli_options:
  api_token: YOUR_TOKEN

3. Common flags

Flag	Purpose
--url	Target WordPress site
-e / --enumerate	What to enumerate (see §4)
--api-token	WPScan DB token for vuln data
--random-user-agent	Rotate User-Agent
--stealthy	Passive detection + random UA, low noise
--force	Scan even if WordPress isn't detected
--disable-tls-checks	Ignore TLS cert errors
--throttle	ms delay between requests
--request-timeout	Per-request timeout (s)
-o / --output	Write to a file
-f / --format	cli, json, cli-no-color, cli-no-colour
--proxy	protocol://host:port (e.g. Burp)
--update	Update the local database

4. Enumeration (-e)

wpscan --url https://target.com -e vp,vt,u

Code	Enumerates
vp	Vulnerable plugins
ap	All plugins
p	Popular plugins
vt	Vulnerable themes
at	All themes
t	Popular themes
u	Users (u1-10 for an ID range)
m	Media IDs
cb	Config backups
dbe	Db exports
tt	Timthumbs

# Aggressive plugin detection (slower, more thorough)
wpscan --url https://target.com -e ap --plugins-detection aggressive
wpscan --url https://target.com -e u1-50        # user IDs 1–50

5. Detection modes

--detection-mode passive|mixed|aggressive          # overall mode
--plugins-detection passive|mixed|aggressive
--plugins-version-detection passive|mixed|aggressive

passive = quiet/fast (relies on the homepage); aggressive = brute path checks, finds hidden plugins/themes.

6. User enumeration

wpscan --url https://target.com -e u
wpscan --url https://target.com -e u1-30

Builds the user list you then feed to a password attack.

7. Password brute force

# xmlrpc multicall is fastest; wp-login fallback
wpscan --url https://target.com -U admin -P passwords.txt
wpscan --url https://target.com -U users.txt -P /usr/share/wordlists/rockyou.txt
wpscan --url https://target.com -P rockyou.txt -U admin \
       --password-attack xmlrpc-multicall --max-threads 20

Flag	Purpose
-U / --usernames	User or file of users
-P / --passwords	Password wordlist
--password-attack	wp-login, xmlrpc, xmlrpc-multicall
--max-threads	Concurrency

8. Real-world examples

# Full audit with vuln data, all the usual enumeration, JSON report
wpscan --url https://target.com --api-token YOUR_TOKEN \
  -e vp,vt,u,cb,dbe --plugins-detection aggressive \
  --random-user-agent -f json -o wpscan.json

# Quiet first pass that won't trip rate limits
wpscan --url https://target.com --stealthy --throttle 500

# Behind Burp for inspection
wpscan --url https://target.com --proxy http://127.0.0.1:8080 --disable-tls-checks

9. Output

wpscan --url https://target.com -o report.txt
wpscan --url https://target.com -f json -o report.json
wpscan --url https://target.com -f cli-no-color -o report.txt

10. Tips

• Add --api-token or you only get version output, not the known-vulnerability mapping — the whole point.
• Use --plugins-detection aggressive to find plugins that aren't referenced on the homepage.
• --stealthy + --throttle keep you under WAF/rate-limit thresholds on production-like targets.
• For brute forcing, xmlrpc-multicall is far faster than wp-login — but block-on-failure plugins can lock you out; throttle and watch for lockouts.
• wpscan --update before a scan to refresh fingerprints and the local DB.

Authorized testing only. Practice on the AYSEC challenges. Related: Nikto