WordPress Penetration Testing
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
Documentation
WordPress Penetration Testing
Purpose
Conduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.
Prerequisites
Required Tools
- WPScan (pre-installed in Kali Linux)
- Metasploit Framework
- Burp Suite or OWASP ZAP
- Nmap for initial discovery
- cURL or wget
Required Knowledge
- WordPress architecture and structure
- Web application testing fundamentals
- HTTP protocol understanding
- Common web vulnerabilities (OWASP Top 10)
Outputs and Deliverables
- WordPress Enumeration Report - Version, themes, plugins, users
- Vulnerability Assessment - Identified CVEs and misconfigurations
- Credential Assessment - Weak password findings
- Exploitation Proof - Shell access documentation
Core Workflow
Phase 1: WordPress Discovery
Identify WordPress installations:
# Check for WordPress indicators
curl -s http://target.com | grep -i wordpress
curl -s http://target.com | grep -i "wp-content"
curl -s http://target.com | grep -i "wp-includes"
# Check common WordPress paths
curl -I http://target.com/wp-login.php
curl -I http://target.com/wp-admin/
curl -I http://target.com/wp-content/
curl -I http://target.com/xmlrpc.php
# Check meta generator tag
curl -s http://target.com | grep "generator"
# Nmap WordPress detection
nmap -p 80,443 --script http-wordpress-enum target.com
Key WordPress files and directories:
/wp-admin/- Admin dashboard/wp-login.php- Login page/wp-content/- Themes, plugins, uploads/wp-includes/- Core files/xmlrpc.php- XML-RPC interface/wp-config.php- Configuration (not accessible if secure)/readme.html- Version information
Phase 2: Basic WPScan Enumeration
Comprehensive WordPress scanning with WPScan:
# Basic scan
wpscan --url http://target.com/wordpress/
# With API token (for vulnerability data)
wpscan --url http://target.com --api-token YOUR_API_TOKEN
# Aggressive detection mode
wpscan --url http://target.com --detection-mode aggressive
# Output to file
wpscan --url http://target.com -o results.txt
# JSON output
wpscan --url http://target.com -f json -o results.json
# Verbose output
wpscan --url http://target.com -v
Phase 3: WordPress Version Detection
Identify WordPress version:
# WPScan version detection
wpscan --url http://target.com
# Manual version checks
curl -s http://target.com/readme.html | grep -i version
curl -s http://target.com/feed/ | grep -i generator
curl -s http://target.com | grep "?ver="
# Check meta generator
curl -s http://target.com | grep 'name="generator"'
# Check RSS feeds
curl -s http://target.com/feed/
curl -s http://target.com/comments/feed/
Version sources:
- Meta generator tag in HTML
- readme.html file
- RSS/Atom feeds
- JavaScript/CSS file versions
Phase 4: Theme Enumeration
Identify installed themes:
# Enumerate all themes
wpscan --url http://target.com -e at
# Enumerate vulnerable themes only
wpscan --url http://target.com -e vt
# Theme enumeration with detection mode
wpscan --url http://target.com -e at --plugins-detection aggressive
# Manual theme detection
curl -s http://target.com | grep "wp-content/themes/"
curl -s http://target.com/wp-content/themes/
Theme vulnerability checks:
# Search for theme exploits
searchsploit wordpress theme <theme_name>
# Check theme version
curl -s http://target.com/wp-content/themes/<theme>/style.css | grep -i version
curl -s http://target.com/wp-content/themes/<theme>/readme.txt
Phase 5: Plugin Enumeration
Identify installed plugins:
# Enumerate all plugins
wpscan --url http://target.com -e ap
# Enumerate vulnerable plugins only
wpscan --url http://target.com -e vp
# Aggressive plugin detection
wpscan --url http://target.com -e ap --plugins-detection aggressive
# Mixed detection mode
wpscan --url http://target.com -e ap --plugins-detection mixed
# Manual plugin discovery
curl -s http://target.com | grep "wp-content/plugins/"
curl -s http://target.com/wp-content/plugins/
Common vulnerable plugins to check:
# Search for plugin exploits
searchsploit wordpress plugin <plugin_name>
searchsploit wordpress mail-masta
searchsploit wordpress slideshow gallery
searchsploit wordpress reflex gallery
# Check plugin version
curl -s http://target.com/wp-content/plugins/<plugin>/readme.txt
Phase 6: User Enumeration
Discover WordPress users:
# WPScan user enumeration
wpscan --url http://target.com -e u
# Enumerate specific number of users
wpscan --url http://target.com -e u1-100
# Author ID enumeration (manual)
for i in {1..20}; do
curl -s "http://target.com/?author=$i" | grep -o 'author/[^/]*/'
done
# JSON API user enumeration (if enabled)
curl -s http://target.com/wp-jso
Quick Info
- Source
- antigravity
- Category
- Security & Systems
- Repository
- View Repo
- Scraped At
- Jan 26, 2026
Tags
Related Skills
Active Directory Attacks
This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.
anti-reversing-techniques
Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use when analyzing protected binaries, bypassing anti-debugging for authorized analysis, or understanding software protection mechanisms.
API Fuzzing for Bug Bounty
This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.