WPSCAN

basic scan

wpscan --url https://brainfuck.htb --disable-tls-checks --api-token sxowPtXt72r0yXxVDs34qF0jNvRuIywRC9y4AXXgMzM

enumerate users:

wpscan --url https://brainfuck.htb --disable-tls-checks --enumerate u

aggressive scan:

wpscan --url http://10.10.10.88:80/webservices/wp -e ap --plugins-detection aggressive --api-token sxowPtXt72r0yXxVDs34qF0jNvRuIywRC9y4AXXgMzM