{"record":{"id":"9921e9eaf674fa4f","repo":"wpscanteam/wpscan","slug":"could-not-find-a-login-interface-to-perform-the-pa","errorCode":null,"errorMessage":"Could not find a login interface to perform the password attack against","messagePattern":"Could not find a login interface to perform the password attack against","errorType":"exception","errorClass":"WPScan::Error::NoLoginInterfaceDetected","httpStatus":null,"severity":"warning","filePath":"app/controllers/password_attack.rb","lineNumber":83,"sourceCode":"      end\n\n      # @return [ WPScan::Finders::Finder ] The finder used to perform the attack\n      def attacker\n        @attacker ||= attacker_from_cli_options || attacker_from_automatic_detection\n      end\n\n      # @return [ Model::XMLRPC ]\n      def xmlrpc\n        @xmlrpc ||= target.xmlrpc\n      end\n\n      # @return [ WPScan::Finders::Finder ]\n      def attacker_from_cli_options\n        return unless ParsedCli.password_attack\n\n        case ParsedCli.password_attack\n        when :wp_login\n          raise Error::NoLoginInterfaceDetected unless target.login_url\n\n          Finders::Passwords::WpLogin.new(target)\n        when :xmlrpc\n          raise Error::XMLRPCNotDetected unless xmlrpc\n\n          Finders::Passwords::XMLRPC.new(xmlrpc)\n        when :xmlrpc_multicall\n          raise Error::XMLRPCNotDetected unless xmlrpc\n\n          Finders::Passwords::XMLRPCMulticall.new(xmlrpc)\n        end\n      end\n\n      # @return [ Boolean ]\n      def xmlrpc_get_users_blogs_enabled?\n        if xmlrpc&.enabled? &&\n           xmlrpc.available_methods.include?('wp.getUsersBlogs') &&\n           !xmlrpc.method_call('wp.getUsersBlogs', [SecureRandom.hex[0, 6], SecureRandom.hex[0, 4]])","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/wpscanteam/wpscan/blob/62c9cef471de90095f6b42245a11d0f8172d19c9/app/controllers/password_attack.rb#L65-L101","documentation":"Raised by PasswordAttack#attacker_from_cli_options (app/controllers/password_attack.rb:83) when --password-attack wp-login is forced but Target#login_url is nil, i.e. no login interface was found at /wp-login.php or at a --login-uri override. Note that PasswordAttack#run rescues exactly this class (app/controllers/password_attack.rb:59) and prints it as a notice, so in a normal CLI run the attack degrades gracefully; it only propagates when the finder is built directly.","triggerScenarios":"`wpscan --url http://target -P passwords.txt --password-attack wp-login` where wp-login.php is 404/oddly redirected and no --login-uri was supplied; or a --login-uri value pointing at a path that does not exist, leaving target.login_url nil at the moment the attacker is instantiated.","commonSituations":"Login page renamed or moved by a security plugin; wp-login.php blocked by a WAF rule; site uses a custom login path; typo in --login-uri.","solutions":["Locate the real login page and pass it: --login-uri /custom-login-path","Drop --password-attack so WPScan auto-detects and falls back to XML-RPC when wp-login is unavailable","Verify the login page in a browser — it may be blocked for your IP specifically"],"exampleFix":"# before\nwpscan --url http://target -P rockyou.txt --password-attack wp-login\n# => Could not find a login interface to perform the password attack against\n\n# after\nwpscan --url http://target -P rockyou.txt --login-uri /member-login","handlingStrategy":"fallback","validationCode":"# Probe the login URL before forcing a wp-login attack\nlogin = WPScan::Target.new(url).login_url\nabort 'no login page — do not force --password-attack wp-login' unless login","typeGuard":null,"tryCatchPattern":"begin\n  attacker = controller.attacker_from_cli_options\nrescue WPScan::Error::NoLoginInterfaceDetected\n  attacker = nil # fall back to automatic detection (XML-RPC) or supply --login-uri\nend","preventionTips":["Confirm the login path exists before pinning --password-attack wp-login","Pass --login-uri whenever the login page is not /wp-login.php","Prefer automatic attack selection unless you have a reason to force one","Check that a WAF is not masking wp-login.php with 403/404"],"tags":["password-attack","wp-login","brute-force","login-uri"],"backgroundTag":"login-page-not-found","analyzedSha":"62c9cef471de90095f6b42245a11d0f8172d19c9","analyzedAt":"2026-08-21T17:10:47.902Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}