---
description: Open-source Content Management System (CMS)
---

# WordPress

WordPress is one of the most popular open source Content Management Systems (CMS) in the world. Written in PHP and usually runs on Apache with MySQL as a backend. [xmlrpc](https://codex.wordpress.org/XML-RPC_Support) communication replaced by WordPress [API REST](https://developer.wordpress.org/rest-api/reference).

## Tools

<table><thead><tr><th width="149">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/wpscanteam/wpscan">wpscan</a></td><td><a href="wordpress">WordPress</a> Security Scanner.<br><code>wpscan --url &#x3C;URL> --random-user-agent -o &#x3C;OUTPUT> -e &#x3C;value> --plugins-detection aggressive --api-token &#x3C;API_KEY></code><br><code>wpscan --url &#x3C;URL> --password-attack &#x3C;xmlrpc/wp-login> -U &#x3C;USER> -P &#x3C;WORDLIST></code></td></tr><tr><td><a href="https://github.com/droope/droopescan">droopescan</a></td><td>A plugin-based scanner that aids security researchers in identifying issues with several CMS.<br><code>droopescan scan wordpress --url &#x3C;URL></code></td></tr></tbody></table>

## Default File Structure

```
/var/www/html
├── index.php
├── license.txt   (version WordPress)
├── readme.html
├── wp-activate.php
├── wp-admin      (admin login page)
|   └── ENDPOINT: /wp-admin/login.php, /wp-admin/wp-login.php, /login.php, /wp-login.php
├── wp-blog-header.php
├── wp-comments-post.php
├── wp-config.php   (database name, database host, username and password, authentication keys and salts, and the database table prefix.)
├── wp-config-sample.php
├── wp-content
|   ├── uploads   (not always)
|   ├── index.php
|   ├── plugins
|   └── themes
├── wp-cron.php
├── wp-includes  (core files like certificates, fonts, JavaScript and widgets)
├── wp-links-opml.php
├── wp-load.php
├── wp-login.php
├── wp-mail.php
├── wp-settings.php
├── wp-signup.php
├── wp-trackback.php
└── xmlrpc.php  (WordPress feature that allows data transmission with HTTP acting as the transport mechanism and XML as the encoding mechanism)
```

## Default Users

<table><thead><tr><th width="217">Role</th><th>Description</th></tr></thead><tbody><tr><td>Administrator</td><td>This user has access to administrative features within the website. This includes adding and deleting users and posts, as well as editing source code.</td></tr><tr><td>Editor</td><td>An editor can publish and manage posts, including posts by other users.</td></tr><tr><td>Author</td><td>Authors can publish and manage their own posts.</td></tr><tr><td>Contributor</td><td>These users can write and manage their own posts but cannot publish them.</td></tr><tr><td>Subscriber</td><td>These are regular users who can browse posts and edit their profiles.</td></tr></tbody></table>

## Manual Enumeration

### Version

<table data-header-hidden><thead><tr><th width="178"></th><th></th></tr></thead><tbody><tr><td>Source code</td><td><p>Meta tag of name generator:<br><code>&#x3C;meta name="generator" content="WordPress 5.3.3" /></code><br>In CSS links:</p><p><code>&#x3C;link ... href='http://.../bootstrap.css?ver=5.3.3' ... /></code><br>In JS links:<br><code>&#x3C;script ... src='http://.../jquery.validationEngine-en.js?ver=5.3.3'></code></p></td></tr><tr><td><code>readme.html</code></td><td>In the WordPress root directory</td></tr><tr><td><code>license.txt</code></td><td>In the WordPress root directory</td></tr></tbody></table>

### Plugins

<table><thead><tr><th width="167"></th><th></th></tr></thead><tbody><tr><td>Passive</td><td><code>curl -s -X GET &#x3C;SITE> | sed 's/href=/\n/g' | sed 's/src=/\n/g' | grep 'wp-content/plugins/*' | cut -d"'" -f2</code><br>Not all installed plugins can be passively detected.</td></tr><tr><td>Active</td><td><code>curl -I -X GET http://blog.inlanefreight.com/wp-content/plugins/mail-masta</code></td></tr><tr><td>Directory Indexing</td><td>Even if a plugin is deactivated, it may still be accessible (both to the scripts and functions associated with it). We navigate to the plugin directory, obtaining the list of files:<br><code>http://&#x3C;DOMAIN>/wp-content/plugins/&#x3C;PLUGIN></code><mark style="color:red;"><strong><code>/</code></strong></mark></td></tr></tbody></table>

### Themes

<table><thead><tr><th width="167"></th><th></th></tr></thead><tbody><tr><td>Passive</td><td><code>curl -s -X GET &#x3C;SITE> | sed 's/href=/\n/g' | sed 's/src=/\n/g' | grep 'themes' | cut -d"'" -f2</code><br>Not all installed themes can be passively detected.</td></tr></tbody></table>

### User Enumeration

<table><thead><tr><th width="170"></th><th></th></tr></thead><tbody><tr><td>Author param</td><td><code>http://&#x3C;DOMAIN>/?author=1</code> (1 is usually admin)</td></tr><tr><td>Users endpoint</td><td>WordPress ≤ 4.7.1 <br><code>http://&#x3C;DOMAIN>/wp-json/wp/v2/users | jq</code> <br>Show all users who had published a post</td></tr></tbody></table>

## Attacks

### Built-in

Login with Admin user.\
Click on `Appearance` on the side panel and select `Theme Editor`. This page will let us edit the PHP source code directly. An inactive theme can be selected to avoid corrupting the primary theme. Click on `Select` after selecting the theme, and we can edit an uncommon page such as `404.php` to add a web shell. Click on `Update File` at the bottom to save. We know that WordPress themes are located at `/wp-content/themes/<theme_name>`.

{% code overflow="wrap" %}
```bash
curl http://<DOMAIN>/wp-content/themes/twentynineteen/404.php?cmd=id
```
{% endcode %}
