Skip to content

Wpscan Cheatsheet

syntax

wpscan --url <target> [options]

Important Flags 

--enumerate p,t,u,vt // p = plugins, t = themes, u = users, vt = vulnerable templates (plugins/themes)

--api-token <token>  // supply API token

--plugins-detection <mode> // passive / active / mixed / aggressive — controls noise level

--disable-tls-checks  // ignore cert errors 

--random-agent / --user-agent // set User Agent

--proxy // set proxy 

--threads // parallel requests

-o <file> and --format // output format

--enumerate ap // plugin enumeration

Full Enumeration 

wpscan --url <url> --enumerate p,t,u,vt --api-token $<api token> -o <output file>

Passive Plugin Enumeration 

wpscan --url <url> --enumerate p --plugins-detection passive

Brute-force Login

wpscan --url <url> --passwords <password list> --usernames <username>

Example: wpscan –url https://example.com –passwords /path/wordlist.txt –usernames admin

Using Proxy

wpscan --url <url> --enumerate p --proxy <proxy>