{"record":{"id":"b7e62eb840f40849","repo":"wpscanteam/wpscan","slug":"the-xml-rpc-interface-was-not-detected","errorCode":null,"errorMessage":"The XML-RPC Interface was not detected.","messagePattern":"The XML-RPC Interface was not detected\\.","errorType":"exception","errorClass":"WPScan::Error::XMLRPCNotDetected","httpStatus":null,"severity":"error","filePath":"app/controllers/password_attack.rb","lineNumber":87,"sourceCode":"        @attacker ||= attacker_from_cli_options || attacker_from_automatic_detection\n      end\n\n      # @return [ Model::XMLRPC ]\n      def xmlrpc\n        @xmlrpc ||= target.xmlrpc\n      end\n\n      # @return [ WPScan::Finders::Finder ]\n      def attacker_from_cli_options\n        return unless ParsedCli.password_attack\n\n        case ParsedCli.password_attack\n        when :wp_login\n          raise Error::NoLoginInterfaceDetected unless target.login_url\n\n          Finders::Passwords::WpLogin.new(target)\n        when :xmlrpc\n          raise Error::XMLRPCNotDetected unless xmlrpc\n\n          Finders::Passwords::XMLRPC.new(xmlrpc)\n        when :xmlrpc_multicall\n          raise Error::XMLRPCNotDetected unless xmlrpc\n\n          Finders::Passwords::XMLRPCMulticall.new(xmlrpc)\n        end\n      end\n\n      # @return [ Boolean ]\n      def xmlrpc_get_users_blogs_enabled?\n        if xmlrpc&.enabled? &&\n           xmlrpc.available_methods.include?('wp.getUsersBlogs') &&\n           !xmlrpc.method_call('wp.getUsersBlogs', [SecureRandom.hex[0, 6], SecureRandom.hex[0, 4]])\n                  .run.body.match?(/>\\s*405\\s*</)\n\n          true\n        else","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/wpscanteam/wpscan/blob/62c9cef471de90095f6b42245a11d0f8172d19c9/app/controllers/password_attack.rb#L69-L105","documentation":"Raised by PasswordAttack#attacker_from_cli_options (app/controllers/password_attack.rb:87) when --password-attack xmlrpc is forced but Target#xmlrpc is nil — /xmlrpc.php was not detected as present on the target. Unlike Error::NoLoginInterfaceDetected, this error is not rescued in PasswordAttack#run, so it aborts the whole scan.","triggerScenarios":"`wpscan --url http://target -P list.txt --password-attack xmlrpc` where the xmlrpc.php probe fails (404, blocked by a security plugin, .htaccess/host-level filter), so `target.xmlrpc` memoizes to nil and the guard `raise Error::XMLRPCNotDetected unless xmlrpc` fires.","commonSituations":"Security plugins (iThemes Security, BulletProof) disabling XML-RPC; server rules blocking xmlrpc.php; hardened WordPress setups removing the endpoint; forcing xmlrpc against sites that never exposed it.","solutions":["Confirm the endpoint: curl https://target/xmlrpc.php (a live endpoint typically answers GET with 405)","Switch the attack: --password-attack wp-login (requires a detectable login page)","Omit --password-attack entirely and let WPScan auto-detect the best available attack","If you administer the site, temporarily re-enable xmlrpc.php for the duration of the scan"],"exampleFix":"# before\nwpscan --url http://target -P rockyou.txt --password-attack xmlrpc\n# => The XML-RPC Interface was not detected.\n\n# after\nwpscan --url http://target -P rockyou.txt --password-attack wp-login","handlingStrategy":"validation","validationCode":"# Probe xmlrpc.php before forcing an xmlrpc attack\nres = Typhoeus.get(\"#{url}/xmlrpc.php\")\nabort 'xmlrpc not usable — use the wp-login attack' unless [200, 405].include?(res.code)","typeGuard":null,"tryCatchPattern":"begin\n  controller.attacker\nrescue WPScan::Error::XMLRPCNotDetected\n  switch_to '--password-attack wp-login' # xmlrpc forced but endpoint absent\nend","preventionTips":["Check /xmlrpc.php reachability before forcing xmlrpc attacks","Prefer automatic attack detection for hardened targets","Remember this variant aborts the scan (unlike the wp-login notice)","Expect XML-RPC to be disabled on security-hardened sites"],"tags":["xmlrpc","password-attack","brute-force","endpoint-blocked"],"backgroundTag":"xmlrpc-disabled","analyzedSha":"62c9cef471de90095f6b42245a11d0f8172d19c9","analyzedAt":"2026-08-21T17:10:47.902Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}