wordpress-hacking

WordPress Hacking

WordPress powers over 40% of the web. Its attack surface is massive: core engine, 60,000+ public plugins, 10,000+ themes, REST API, XML-RPC, admin-ajax, custom PHP endpoints, WooCommerce storefronts, and multisite networks. A single outdated plugin can give you a shell. Master the enumeration-to-exploitation pipeline and you will pop WordPress sites systematically.

Triage Workflow

Follow this sequence for every WordPress target. Each step feeds the next.

Step 1 -- Confirm WordPress and Detect Version

Before running any scanner, confirm the target is WordPress and fingerprint the exact version. This determines which CVEs apply.

# Quick confirmation — check meta generator, login page, and common paths
curl -sI https://TARGET/ | grep -i 'x-powered-by\|x-redirect-by\|link.*wp-json'
curl -s https://TARGET/ | grep -oP 'content="WordPress \K[0-9.]+'
curl -s https://TARGET/readme.html | head -20
curl -s https://TARGET/feed/ | grep '<generator>'
curl -s https://TARGET/wp-includes/js/wp-emoji-release.min.js | head -1

Multiple version detection methods exist because admins disable some but rarely all. See references/wp-enum.md for the full fingerprinting matrix.

Record findings immediately:

node ${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js add \
  "https://TARGET" info-leak "wp-version" INFO \
  "WordPress X.Y.Z detected via meta generator"

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add \
  "TARGET" tech-stack "cms" "wordpress-X.Y.Z" --source "version-detection"

Step 2 -- Security Plugin Detection

Before aggressive scanning, identify security plugins that will block or log you. This dictates your OPSEC profile.

# Check for common security plugin signatures
curl -s https://TARGET/ | grep -iE 'wordfence|sucuri|ithemes-security|better-wp-security|all-in-one-wp-security|shield-security|bulletproof'
curl -sI https://TARGET/wp-login.php | grep -i 'x-sucuri\|x-waf'
curl -s https://TARGET/wp-content/plugins/ 2>/dev/null | grep -oP 'href="[^"]*"' | grep -iE 'wordfence|sucuri|ithemes|bulletproof|shield|cerber'