wordpress-penetration-testing

name: WordPress Penetration Testing description: This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies. metadata: author: zebbern version: 4.1.0-fractal

WordPress Penetration Testing

Purpose

Conduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.

Prerequisites

🧠 Knowledge Modules (Fractal Skills)

1. Required Tools

2. Required Knowledge

3. Phase 1: WordPress Discovery

4. Phase 2: Basic WPScan Enumeration

5. Phase 3: WordPress Version Detection

6. Phase 4: Theme Enumeration

7. Phase 5: Plugin Enumeration

8. Phase 6: User Enumeration

9. Phase 7: Comprehensive Enumeration

10. Phase 8: Password Attacks

11. Phase 9: Vulnerability Exploitation

12. Phase 10: Advanced Techniques

13. WPScan Enumeration Flags

14. Common WordPress Paths

15. WPScan Command Examples

16. Legal Considerations

17. Technical Limitations

18. Detection Evasion

19. WPScan Shows No Vulnerabilities

20. Brute-Force Blocked

21. Cannot Access Admin Panel