{"record":{"id":"263e97760879305c","repo":"wpscanteam/wpscan","slug":"the-number-of-themes-detected-reached-the-threshol","errorCode":null,"errorMessage":"The number of themes detected reached the threshold of #{ParsedCli.themes_threshold} which might indicate False Positive. You can use --themes-threshold to increase or disable this limit (set to 0 to disable), or use --exclude-content-based to ignore bad responses.","messagePattern":"The number of themes detected reached the threshold of #(.+?) which might indicate False Positive\\. You can use --themes-threshold to increase or disable this limit \\(set to 0 to disable\\), or use --exclude-content-based to ignore bad responses\\.","errorType":"exception","errorClass":"WPScan::Error::ThemesThresholdReached","httpStatus":null,"severity":"error","filePath":"app/finders/themes/known_locations.rb","lineNumber":35,"sourceCode":"        # @option opts [ Findings ] :found Shared findings collection; see\n        #   {Plugins::KnownLocations#aggressive} for the streaming rationale.\n        #\n        # @return [ Array<Theme> ]\n        def aggressive(opts = {})\n          shared = opts[:found]\n          local  = shared ? nil : []\n          count  = 0\n\n          enumerate(target_urls(opts), opts.merge(check_full_response: true)) do |res, slug|\n            finding_opts = opts.merge(found_by: found_by,\n                                      confidence: 80,\n                                      interesting_entries: [\"#{res.effective_url}, status: #{res.code}\"])\n\n            theme = Model::Theme.new(slug, target, finding_opts)\n            (shared || local) << theme\n            count += 1\n\n            raise Error::ThemesThresholdReached if opts[:threshold].positive? && count >= opts[:threshold]\n          end\n\n          local || []\n        end\n\n        # @param [ Hash ] opts\n        # @option opts [ String ] :list\n        #\n        # @return [ Hash ]\n        def target_urls(opts = {})\n          slugs = opts[:list] || DB::Themes.vulnerable_slugs\n          urls  = {}\n\n          slugs.each do |slug|\n            urls[target.theme_url(slug)] = slug\n          end\n\n          urls","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/wpscanteam/wpscan/blob/62c9cef471de90095f6b42245a11d0f8172d19c9/app/finders/themes/known_locations.rb#L17-L53","documentation":"Raised inside Themes::KnownLocations#aggressive (app/finders/themes/known_locations.rb:35) when the number of detected themes reaches opts[:threshold] (default 20, from --themes-threshold) during known-location brute force. As with plugins, any 200/401/403/500 response counts as a detection, so a catch-all server (or a theme-heavy install) trips the guard, which aborts the enumeration to prevent false-positive floods.","triggerScenarios":"`wpscan --url http://t -e at` where nonexistent theme paths under the themes dir all return 200/401/403/500 (wildcard routing, global auth wall, soft-404 pages), reaching 20 detections from DB::Themes.vulnerable_slugs with the default threshold of 20.","commonSituations":"Catch-all routers and soft-404 configurations; whole-site basic auth; staging servers with generic error pages; large multisite networks with many themes and the default threshold left unchanged.","solutions":["Confirm the false-positive pattern: curl a random nonexistent theme URL and check the status code","Add --exclude-content-based '<regex>' to discard bogus response bodies","Raise or disable the guard when detections are real: --themes-threshold 50 or --themes-threshold 0"],"exampleFix":"# before\nwpscan --url http://t -e at\n# => The number of themes detected reached the threshold of 20 ...\n\n# after\nwpscan --url http://t -e at --exclude-content-based 'nothing-found'\n# or, if detections are legit: --themes-threshold 0","handlingStrategy":"fallback","validationCode":"# Detect catch-all behavior before enumerating themes\nrandom_slug = rand(36**12).to_s(36)\nprobe = Typhoeus.get(\"#{url}/wp-content/themes/#{random_slug}/\")\nabort 'catch-all server: use --exclude-content-based or --themes-threshold 0' if probe.code == 200","typeGuard":"# Threshold option guard: 0 disables the abort, positive enables it\nthreshold_active = opts[:threshold].is_a?(Integer) && opts[:threshold].positive?","tryCatchPattern":"begin\n  finder.aggressive(opts)\nrescue WPScan::Error::ThemesThresholdReached\n  retry opts.merge(threshold: 0, exclude_content_based: pattern) # only after verifying detections are real\nend","preventionTips":["Probe a random theme slug URL first to detect catch-all 200 behavior","Use --exclude-content-based on sites with soft-404 pages","Tune --themes-threshold (default 20) for theme-heavy networks","Never set --themes-threshold 0 blindly on untrusted targets — verify detections manually"],"tags":["enumeration","themes","false-positive","threshold","catch-all"],"backgroundTag":"enumeration-threshold-exceeded","analyzedSha":"62c9cef471de90095f6b42245a11d0f8172d19c9","analyzedAt":"2026-08-21T17:10:47.902Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}