Flag	Purpose
`--url <url>`	Target WordPress URL
`--enumerate <items>`	u=users, p=plugins, t=themes, vp=vuln plugins, vt=vuln themes, ap=all plugins, at=all themes, tt=timthumbs, cb=config backups, dbe=db exports, m=media ids
`--api-token <token>`	WPScan API token (required for CVE data)
`-U <user>`	Username (or file) for brute-force
`-P <wordlist>`	Password wordlist
`--password-attack`	`xmlrpc` / `xmlrpc-multicall` / `wp-login`
`--plugins-detection` / `--themes-detection`	`aggressive` / `passive` / `mixed`
`--usernames <list>`	Usernames to brute-force (comma-sep or file)
`--proxy <proxy>`	HTTP proxy (e.g., `http://127.0.0.1:8080`)
`--cookie <str>`	Cookie for authenticated scans
`--headers <str>`	Custom HTTP headers
`--http-auth <u:p>`	HTTP basic auth
`-o <file>`	Output file
`--format <fmt>`	cli / json / cli-no-colour
`--throttle <ms>`	Milliseconds between requests
`--request-timeout <n>`	Timeout per request
`--connect-timeout <n>`	Connection timeout
`--max-threads <n>`	Max concurrent threads (default 5)
`--wp-content-dir <dir>`	Override wp-content dir if non-standard
`--wp-plugins-dir <dir>`	Override plugins dir
`--disable-tls-checks`	Skip SSL verification
`--ignore-main-redirect`	Don't follow main domain redirect
`--force`	Proceed even if target isn't WordPress
`--update`	Update WPScan database
`-v` / `--verbose`	Verbose output
`--stealthy`	Passive detection only + random UA

Enumeration Targets

# Users only (fastest, high value)
wpscan --url https://target.com --enumerate u

# Vulnerable plugins only (most impactful)
wpscan --url https://target.com --enumerate vp --api-token $TOKEN

# Enumerate selected component categories
wpscan --url https://target.com \
    --enumerate ap,at,u,tt,cb,dbe \
    --api-token $TOKEN

# Config backups (wp-config.php.bak, wp-config.php~, etc.)
wpscan --url https://target.com --enumerate cb

# Database exports
wpscan --url https://target.com --enumerate dbe

Password Attacks

# Brute-force via wp-login.php (slower, stealthier)
wpscan --url https://target.com \
    --usernames admin \
    --passwords /usr/share/wordlists/rockyou.txt \
    --password-attack wp-login

# XML-RPC multicall (faster, bypasses rate limiting)
wpscan --url https://target.com \
    --usernames admin \
    --passwords /usr/share/wordlists/rockyou.txt \
    --password-attack xmlrpc-multicall

# Enumerate users first, then attack
wpscan --url https://target.com --enumerate u --api-token $TOKEN -o users.json --format json
cat users.json | jq -r '.users[].username' > found_users.txt
wpscan --url https://target.com -U found_users.txt -P passwords.txt

Authenticated Scanning

# With session cookie (login via browser first)
wpscan --url https://target.com \
    --cookie "wordpress_logged_in_xxx=admin%7C..."

# With an existing authenticated session
wpscan --url https://target.com \
    --enumerate ap \
    --cookie 'wordpress_logged_in_example=SESSION_VALUE'

Common Findings

Finding	Impact
Outdated plugins with CVEs	RCE / LFI / SQLi
User enumeration via author archive	Enables password attacks
xmlrpc.php enabled	Brute-force amplification (multicall = 500 tries/request)
readme.html / license.txt	WordPress version disclosure
Timthumb vulnerability	Remote code execution
Debug log exposed (`/wp-content/debug.log`)	Info disclosure, credentials
Config backup (`wp-config.php.bak`)	Database credentials
DB export in web root	Full database dump
Registration open	Account creation → plugin exploit

Common Workflows

# Quick recon pass
wpscan --url https://target.com --enumerate u,vp,vt \
    --api-token $TOKEN -o wp_scan.json --format json

# Parse JSON output for CVEs
cat wp_scan.json | jq '.plugins | to_entries[] | {plugin: .key, vulns: .value.vulnerabilities}'

# Stealthy scan (minimize fingerprint)
wpscan --url https://target.com --stealthy --enumerate u \
    --throttle 2000

# Through proxy for manual review
wpscan --url https://target.com --proxy http://127.0.0.1:8080 \
    --disable-tls-checks --enumerate u,vp --api-token $TOKEN

Key Attack Paths

1. Enumerate users → brute-force weak passwords → admin access → RCE via theme editor
2. Find vulnerable plugin (CVE) → exploit SQLi/LFI/RCE directly
3. xmlrpc.php enabled → multicall brute-force (bypass account lockout)
4. Config backup found → extract DB creds → wp_users table → crack password hashes
5. Registration enabled + vulnerable plugin → account takeover chain

Resources

File	When to load
`references/wordpress-testing.md`	XML-RPC abuse, REST API enum, auth bypass, manual exploitation

wpscan

WPScan

Quick Start

Core Flags