WordPress Penetration Testing Guide

“WordPress covers about 35% of the total share of websites on the internet. Its widespread use also makes it the single largest target surface for hackers and cyber-attacks worldwide.”

WordPress stopped being a blogging tool a long time ago. It is the Content Management System behind roughly a third of the web, from one-page portfolios to Fortune 500 marketing estates, and that reach is exactly why it is the highest-value target in web application testing—own the CMS and you frequently own the brand’s public face. WordPress Penetration Testing Guide is a heavy operational manual that runs the whole kill chain, from standing up the infrastructure to leaving a persistent backdoor behind.

Surgical Enumeration

Nothing gets exploited until the target is mapped. The guide leans on WPScan to fingerprint the installation before a single payload is fired:

• Version Detection: Pin the exact core version so you can cross-reference known CVEs instead of guessing.
• Theme Enumeration: Find installed themes, especially the abandoned ones nobody has updated in three years.
• Plugin Enumeration: List every active and inactive plugin—this is the real attack surface, since the core is hardened but the third-party plugin someone installed once and forgot is not.
• Username Harvesting: Pull valid admin usernames through the REST API and author-archive enumeration, turning a password attack from a two-variable problem into a one-variable one.

Multi-Vector Exploitation

Once the target is mapped, the guide works through the exploitation options:

• Credential Attacks: The exact syntax for hitting wp-login.php three ways—WPScan dictionary runs, Metasploit’s wp_login_enum, and hand-configured Burp Suite Intruder—covered in depth in the companion Cracking Login volume.
• Shell Upload via Metasploit: How an already-compromised admin session becomes a full Meterpreter shell dropped into the uploads directory. Note the ordering: this is post-authentication, so it presumes the credential attack already landed.
• Vulnerable Plugin Exploitation: The higher-value path—outdated or sloppily coded plugins that hand over SQL Injection, Local File Inclusion (LFI), or Remote Code Execution outright, often with no login required at all. This is where most real WordPress compromises actually start.

Persistent Backdoor Installation

The most advanced section covers holding access after the first compromise, which is where a test stops being a demo and starts modelling a real breach:

• Malicious Code Injection: Dropping a PHP reverse shell into the active theme’s functions.php or 404.php. Cheap and effective, and also fragile—a theme update overwrites it, so it does not survive routine maintenance.
• Malicious Plugin Upload: Packaging a PHP backdoor as a plausible-looking plugin and installing it through the dashboard. More durable, more visible in the plugin list, so it trades stealth for staying power.
• WetW0rk Framework: Purpose-built offensive plugins that generate encrypted reverse-shell callbacks to slip past basic file-integrity monitoring—the option that assumes the defender is actually watching.

Who Is This Book REALLY For?

• Web Application Penetration Testers: A full reference for auditing WordPress end to end, enumeration through persistence, in one place.
• WordPress Developers & Administrators: The concrete case for the hygiene everyone nods at and skips—patching plugins, disabling XML-RPC, putting a WAF in front, tightening file permissions—shown as the specific attacks each one blocks.
• Bug Bounty Hunters: A repeatable methodology for finding and reporting critical issues across the millions of sites running configurations like the ones in this book.

The Bottom Line

WordPress Penetration Testing Guide is a working playbook, not a theory paper. Its thesis is blunt and correct: the platform behind a third of the internet is only ever as secure as its weakest plugin—and there is almost always a weakest plugin.