/wordpress-hacking

name: wordpress-hacking
description: |
  Activate this skill whenever the user mentions WordPress, WP, WooCommerce, WP plugin,
  WP theme, wp-admin, wp-content, wp-login, wp-json, wp-includes, xmlrpc, XML-RPC,
  wp-cron, admin-ajax, wp-config, wpscan, WordPress vulnerability, WordPress exploit,
  WordPress enumeration, WordPress brute force, WordPress RCE, WordPress shell upload,
  WordPress backdoor, WordPress privilege escalation, WordPress authentication bypass,
  WordPress REST API, WordPress nonce, WordPress application password,
  plugin vulnerability, theme vulnerability, WooCommerce exploit, WooCommerce injection,
  Wordfence, Sucuri, iThemes Security, All-in-One WP Security, WP security plugin,
  WordPress multisite, WordPress network, WordPress mu-plugins, must-use plugins,
  WordPress file upload, WordPress SQLi, WordPress XSS, WordPress SSRF, WordPress LFI,
  WordPress deserialization, WordPress object injection, WordPress CSRF,
  Elementor, WPBakery, Contact Form 7, Yoast, ACF, Advanced Custom Fields,
  Gravity Forms, WP File Manager, RevSlider, LayerSlider, ThemeGrill,
  WordPress user enumeration, WordPress version detection, WordPress fingerprinting,
  /wp-login.php, /wp-admin/, /wp-content/uploads/, /wp-includes/, /xmlrpc.php,
  readme.html, license.txt, wp-signup.php, wp-activate.php, wp-trackback.php,
  WordPress database, wp_users, wp_options, wp_usermeta, WordPress hash cracking,
  phpass, WordPress password hash, $P$ hash,
  WordPress penetration testing, WordPress security assessment, WordPress audit,
  WordPress attack surface, WordPress hacking methodology.
version: 2.0.0

WordPress Hacking

WordPress powers over 40% of the web. Its attack surface is massive: core engine, 60,000+ public plugins, 10,000+ themes, REST API, XML-RPC, admin-ajax, custom PHP endpoints, WooCommerce storefronts, and multisite networks. A single outdated plugin can give you a shell. Master the enumeration-to-exploitation pipeline and you will pop WordPress sites systematically.

Triage Workflow

Follow this sequence for every WordPress target. Each step feeds the next.

Step 1 -- Confirm WordPress and Detect Version

Before running any scanner, confirm the target is WordPress and fingerprint the exact version. This determines which CVEs apply.

# Quick confirmation — check meta generator, login page, and common paths
curl -sI https://TARGET/ | grep -i 'x-powered-by\|x-redirect-by\|link.*wp-json'
curl -s https://TARGET/ | grep -oP 'content="WordPress \K[0-9.]+'
curl -s https://TARGET/readme.html | head -20
curl -s https://TARGET/feed/ | grep '<generator>'
curl -s https://TARGET/wp-includes/js/wp-emoji-release.min.js | head -1

Multiple version detection methods exist because admins disable some but rarely all. See `references/wp-enum.md` for the full fingerprinting matrix.

Record findings immediately:

node ${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js add \
  "https://TARGET" info-leak "wp-version" INFO \
  "WordPress X.Y.Z detected via meta generator"

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add \
  "TARGET" tech-stack "cms" "wordpress-X.Y.Z" --source "version-detection"

Step 2 -- Security Plugin Detection

Before aggressive scanning, identify security plugins that will block or log you. This dictates your OPSEC profile.

# Check for common security plugin signatures
curl -s https://TARGET/ | grep -iE 'wordfence|sucuri|ithemes-security|better-wp-security|all-in-one-wp-security|shield-security|bulletproof'
curl -sI https://TARGET/wp-login.php | grep -i 'x-sucuri\|x-waf'
curl -s https://TARGET/wp-content/plugins/ 2>/dev/null | grep -oP 'href="[^"]*"' | grep -iE 'wordfence|sucuri|ithemes|bulletproof|shield|cerber'

| Security Plugin | Detection Signature | Impact on Testing | |----------------|---------------------|-------------------| | Wordfence | `wordfence` in source, `/wp-content/plugins/wordfence/` | Rate limiting, IP blocking, live traffic view, login lockout | | Sucuri | `X-Sucuri-ID` header, Sucuri WAF CloudProxy | CDN/WAF layer, request filtering, GeoIP blocking | | iThemes Security | `better-wp-security` plugin dir | Brute force protection, 404 lockout, file change detection | | WP Cerber | `wp-cerber` plugin dir | Aggressive rate limiting, custom login URL, IP subnet blocking | | Shield Security | `wp-simple-firewall` plugin dir | Bot detection, comment/form SPAM, 2FA enforcement |

Log detected defenses:

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add \
  "TARGET" defense "security-plugin" "wordfence-active" --source "fingerprinting"

Step 3 -- User Enumeration

Enumerate WordPress users to build a target list for brute force and social engineering. Multiple methods exist because admins block some but not all.

# WPScan user enumeration
wpscan --url https://TARGET --enumerate u --disable-tls-checks

# Manual methods (when wpscan is blocked)
# Author archives — IDs 1-50
for i in $(seq 1 50); do curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" "https://TARGET/?author=$i"; done

# REST API
curl -s https://TARGET/wp-json/wp/v2/users | jq '.[].slug'
curl -s 'https://TARGET/?rest_route=/wp/v2/users' | jq '.[].slug'

# oEmbed
curl -s "https://TARGET/wp-json/oembed/1.0/embed?url=https://TARGET/" | jq '.author_name'

# Login error oracle
curl -s -d 'log=admin&pwd=wrong&wp-submit=Log+In' https://TARGET/wp-login.php | grep -oP 'Error.*?<'

See `references/wp-enum.md` for all enumeration vectors.

Step 4 -- Plugin and Theme Enumeration

Plugins are the primary attack surface. Enumerate aggressively.

# WPScan — aggressive plugin detection (tests ~100k slugs)
wpscan --url https://TARGET --enumerate ap --plugins-detection aggressive --disable-tls-checks

# WPScan — vulnerable plugins only (faster)
wpscan --url https://TARGET --enumerate vp --disable-tls-checks

# Theme enumeration
wpscan --url https://TARGET --enumerate at --disable-tls-checks

# Combined comprehe