Skip to main content
WordPress powers a huge share of the web, and almost all of its attack surface comes from the plugin and theme ecosystem rather than WordPress core itself. The workflow is usually: fingerprint the version and installed plugins/themes, cross-reference them against known CVEs, then escalate from there, whether that’s a vulnerable plugin, exposed credentials, or a straightforward admin-panel upload once you have valid creds.

Unauthenticated Recon

Version fingerprinting, user enumeration, plugin/theme discovery. No credentials needed, mostly passive against the app itself.

Authenticated Exploitation

Once you have any valid login (even a low-privilege one), the theme editor and plugin upload both turn straight into code execution.

​
WPScan

WPScan is purpose-built for WordPress and does in one tool what would otherwise take a handful of manual requests, version fingerprinting, plugin/theme enumeration against a vulnerability database, and user enumeration.
Enumerate registered usernames, often the first step toward a login brute force.
Enumerate installed plugins with known vulnerabilities, almost always the fastest path to a CVE-based exploit.
A broader sweep across plugins, users, themes, and timthumb scripts in one run, with aggressive plugin detection for better coverage.
--plugins-detection controls how hard WPScan looks for installed plugins. passive only checks the homepage source, aggressive brute-forces the plugins directory against its full list (slow but thorough), and mixed does both, generally the best balance.
Login brute forcing against the standard form, or specifically through XML-RPC (see below), which can be faster since it allows batching multiple credential checks per request.
An API token (free tier available) unlocks WPScan’s full vulnerability database lookups for plugins and themes. Without one, enumeration still works but you won’t get CVE details for what’s found.

​
Enumerate Options Reference

The -e/--enumerate flag accepts a comma-separated list of what to scan for.
OptionDescription
vpVulnerable plugins
apAll plugins (slow)
pPopular plugins only
vtVulnerable themes
atAll themes
tPopular themes only
uUsernames (ranges supported, e.g. u1-5)
cbConfig backups (publicly exposed wp-config.php backups)
dbeDB exports (exposed .sql dumps)
ttTimthumb scripts
mMedia IDs (ranges supported, e.g. m1-15)

​
Manual Enumeration Without WPScan

​
WP-JSON REST API

WordPress’s built-in REST API leaks user data by default on many installs, worth checking even if WPScan’s user enumeration comes up empty.
/wp-json/wp/v2/pages can leak the server’s internal IP address in some configurations, worth checking during internal network mapping.
Author ID brute-forcing is an older but still-working user enumeration trick, a valid author ID 302-redirects to that user’s public author page (revealing their username in the URL), while an invalid one returns a 404.

​
Interesting Paths

PathWhat’s there
/wp-content/plugins/Installed plugins
/wp-content/themes/Installed themes
/wp-login.phpLogin form
/wp-admin/Admin dashboard (post-login)
/wp-config.phpDB credentials and auth keys, should never be reachable directly
/license.txt, /readme.htmlOften leak the exact WordPress version
/xmlrpc.phpLegacy RPC API, see above

​
Getting a Webshell (Authenticated)

Once you have admin (or any account with theme-editing rights), the built-in theme editor is the fastest path to code execution, no file upload functionality needed.
1

Edit a theme file

In the WordPress admin dashboard, go to Appearance → Theme Editor, pick a rarely-used template (a 404 page is a safe choice since it’s not linked anywhere), and insert a one-line PHP backdoor:
2

Trigger it directly

Request the modified file with your command in the query string:
If the theme editor is disabled or locked down, Plugins → Add New → Upload Plugin with a malicious ZIP (a plugin containing a webshell in its main PHP file) achieves the same result and is often overlooked as an upload vector.

​
Quick Reference Tools

Hackviser: WPScan

Reference used for this page.

HackTricks: WordPress

Deeper dive into XML-RPC, SSRF, and DoS angles covered above.

WPScan

The primary WordPress enumeration and vulnerability scanning tool.

WPScan Vulnerability Database

Free API token for full plugin/theme CVE lookups.
Brute forcing logins and uploading plugins both leave obvious artifacts (failed login logs, a new plugin in the dashboard). Make sure both are explicitly in scope before using them.