> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/web-enumeration/tools/cms/wpscan.md).

# wpscan

**WPScan** is a WordPress vulnerability scanner that can identify known vulnerabilities in the core WordPress files, themes, and plugins. It can also perform brute-force attacks and enumerate users.

* Scan the target WordPress site for vulnerabilities

  ```bash
  wpscan --url http://example.com
  ```
* Enumerate usernames

  ```bash
  wpscan --url http://example.com --enumerate u
  ```
* Enumerate plugins

  ```bash
  wpscan --url http://example.com --enumerate p
  ```
* Enumerate themes

  ```bash
  wpscan --url http://example.com --enumerate t
  ```
* Enumerate vulnerable plugins

  ```bash
  wpscan --url http://example.com --enumerate vp
  ```
* Enumerate vulnerable themes

  ```bash
  wpscan --url http://example.com --enumerate vt
  ```
* Enumerate WordPress version

  ```bash
  wpscan --url http://example.com --enumerate v
  ```
* Enumerate all options (users, plugins, themes, version, etc.)

  ```bash
  wpscan --url http://example.com --enumerate ap
  ```
* Provide the API token to access the WPVulnDB vulnerability database

  ```bash
  wpscan --url http://example.com --api-token YOUR_TOKEN_HERE
  ```
* Brute force login using a wordlist of passwords

  ```bash
  wpscan --url http://example.com --passwords passwords.txt --usernames admin
  ```
* Brute force login with a user enumeration step

  ```bash
  wpscan --url http://example.com --enumerate u --passwords passwords.txt
  ```
* Use a random User-Agent to evade basic detection

  ```bash
  wpscan --url http://example.com --random-user-agent
  ```
* Use a proxy to route requests

  ```bash
  wpscan --url http://example.com --proxy http://127.0.0.1:8080
  ```
* Save output in JSON format

  ```bash
  wpscan --url http://example.com --format json -o result.json
  ```
* Save output in CLI (text) format

  ```bash
  wpscan --url http://example.com --format cli -o result.txt
  ```