WordPress Enumeration and Common Attack Vectors

Because WordPress powers a large share of public websites and relies heavily on third-party plugins and themes, authorized penetration tests routinely include structured WordPress enumeration. Understanding what information a site leaks by default is the first step toward hardening it.

Common Enumeration Surfaces

During authorized assessments, reconnaissance typically inspects predictable WordPress endpoints and paths:

• User Enumeration: Querying /wp-json/wp/v2/users via the REST API or cycling author archives such as /?author=1 often exposes valid login usernames.
• Authentication Endpoints: /wp-login.php and /wp-admin/ expose login forms for credential-stuffing or brute-force checks when rate limiting and MFA are absent.
• XML-RPC: /xmlrpc.php, when left enabled for legacy clients, allows system.multicall requests that amplify authentication attempts and SSRF-adjacent pingback abuse.
• Plugin and Theme Footprints: Static assets under /wp-content/plugins/ and /wp-content/themes/ (including readme.txt files and version query strings) reveal installed components and patch levels.

Frequent Attack Vectors

1. Outdated Plugins and Themes: Most real-world WordPress compromises exploit unpatched third-party extensions (SQL injection, authenticated/unauthenticated file upload, XSS, or LFI) rather than WordPress core.
2. Weak Administrative Hygiene: Reused passwords, exposed admin accounts, and lack of multi-factor authentication on privileged roles.
3. Configuration Leaks: Publicly readable backup archives (wp-config.php.bak, .zip dumps), directory listing on uploads, or overly permissive file permissions.

Defensive Hardening Checklist

• Enforce MFA for all administrator and editor accounts, and avoid predictable usernames.
• Restrict or disable /xmlrpc.php unless an active integration explicitly requires it.
• Block unauthenticated user enumeration on /wp-json/wp/v2/users and author archive redirects where business workflows allow.
• Keep WordPress core, plugins, and themes updated, and remove unused extensions completely instead of merely deactivating them.
• Deploy rate limiting and a WAF, enable file integrity monitoring (FIM) on web roots, and maintain tested off-site backups.