WordPress Enumeration: Finding the Plugin That Gets You In

0s7 min★ 30 XP

Lesson 4Interactive lesson

WordPress Enumeration: Finding the Plugin That Gets You In

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format15 sections4 code blocks1 practice itemUpdated Aug 27, 2026

#32.5% of the Internet Runs WordPress. You Will Find It.#link

WordPress powers nearly a third of all websites. 54% of its nearly 4,000 known vulnerabilities come from plugins. 31.5% from core. 14.5% from themes. Your job is to identify which plugins are installed, what version they're running, and whether a public exploit exists.

Manual fingerprinting before touching any tool

Confirming WordPress and extracting version

root@vulnarex:~#curl -s http://blog.inlanefreight.local | grep WordPress

Identifying installed plugins from page source

root@vulnarex:~#curl -s http://blog.inlanefreight.local/ | grep plugins

Two plugins visible already: Contact Form 7 version 5.4.2 and mail-masta. Browsing to the mail-masta directory reveals directory listing is enabled and a readme.txt confirms version 1.0.0. That version has an unauthenticated Local File Inclusion published in August 2021.

Checking another page for hidden plugins

Finding wpDiscuz on a post page

root@vulnarex:~#curl -s http://blog.inlanefreight.local/?p=1 | grep plugins

wpDiscuz 7.0.4. A quick search reveals an unauthenticated remote code execution vulnerability from June 2021. Note it down. Don't exploit yet. There might be more.

Automated enumeration with WPScan

WPScan full enumeration with API token

root@vulnarex:~#sudo wpscan --url http://blog.inlanefreight.local --enumerate --api-token dEOFBxxxxxxxxxxxx

WPScan confirmed the version, found the theme (Transport Gravity, a child theme of Business Gravity), validated the mail-masta vulnerabilities, and enumerated two users: admin and john. But it missed wpDiscuz and Contact Form 7 entirely. Manual enumeration caught what the scanner didn't.

STRICT SECURE AUDIT RULE

WPScan missed two of four installed plugins. Automated tools supplement manual work—they never replace it. Always grep page source across multiple pages before trusting scanner output.

★ 30 XP

SYNTAX VALIDATION (★ 30 XP)

Type the curl command to check if WordPress directory listing is enabled on the uploads folder:

root@vulnarex:~#

Press Enter to submit

You now have: WordPress 5.8, two users, three vulnerable plugins, directory listing enabled, and XML-RPC active. That's more than enough to start attacking. The question is which path gives you the fastest RCE.

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 30 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

32.5% of the Internet Runs WordPress. You Will Find It.

Content

Last updated

August 27, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "/api/content/lessons?courseSlug=attacking-common-applications&lessonSlug=04-wordpress-enumeration&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.