WordPress
Directory map
- WordPress — Discovery & Enumeration — footprinting, manual enumeration, user roles, WPScan
- Attacking WordPress — login brute force, theme editor RCE, Metasploit shell upload, mail-masta LFI, wpDiscuz RCE
Summary
WordPress is the most widely deployed CMS on the internet (~32.5% of all sites), making it a near-certain encounter during external penetration tests. It runs PHP on Apache with a MySQL backend and exposes a predictable directory structure: /wp-admin/ (admin dashboard), /wp-content/plugins/, /wp-content/themes/, and /wp-login.php. The presence of these paths in robots.txt or page source is usually enough to confirm a WordPress installation.
Manual enumeration starts with curl | grep WordPress to extract the version from the <meta name="generator"> tag, then grep themes and grep plugins across multiple page URLs to map installed components and their versions (exposed via ?ver= query parameters). Plugin readme.txt files — often accessible when directory listing is enabled — confirm exact versions. Many plugins carry publicly known CVEs; mail-masta 1.0.0 (LFI), wpDiscuz 7.0.4 (unauthenticated RCE), and outdated core versions are common findings.
User enumeration is possible because WordPress returns distinct error messages for unknown usernames versus wrong passwords at /wp-login.php. WPScan (wpscan --url TARGET --enumerate --api-token TOKEN) automates core/theme/plugin/user enumeration and maps findings to CVEs via WPVulnDB (free tier: 25 requests/day). Automated scanning alone is insufficient — WPScan only sees plugins referenced on scanned pages; manual curl | grep plugins across multiple posts catches the rest. The two methods must be combined.
Attacking WordPress follows a two-stage pattern. First, obtain admin credentials — WPScan brute-forces /xmlrpc.php (preferred for speed) or /wp-login.php using --password-attack xmlrpc. With credentials, the theme editor (Appearance → Theme Editor) allows injecting a one-line PHP web shell (system($_GET[0]);) into an inactive theme’s 404.php, reachable at /wp-content/themes/<theme>/404.php?0=<cmd>. The Metasploit module exploit/unix/webapp/wp_admin_shell_upload automates this as a plugin upload. Plugin CVEs can bypass authentication entirely: mail-masta 1.0.0 exposes an unauthenticated LFI via an unsanitized include($_GET['pl']), and wpDiscuz 7.0.4 (CVE-2020-24186) allows unauthenticated file upload via MIME type bypass, resulting in a PHP web shell in /wp-content/uploads/.