Agent skill · security · davila7
WordPress Penetration Testing
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
Why this skill is useful
Adds executable scripts for WordPress vulnerability scanning and exploitation that are not commonly known or documented.
What it needs
Requires burp-suite, curl, metasploit, nmap, wpscan installed locally. About 6k tokens when loaded. Last updated 2026-08-06. 30,138 stars on the source repository.
What this skill does
WordPress Penetration Testing Purpose Conduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing. Prerequisites Required Tools WPScan (pre-installed in Kali Linux) Metasploit Framework Burp Suite or OWASP ZAP Nmap for initial discovery cURL or wget Required Knowledge WordPress architecture and structure Web application testing fundamentals HTTP protocol understanding Common web vulnerabilities (OWASP Top 10) Outputs and Deliverables 1. WordPress Enumeration Report - Version, themes, plugins, users 2. Vulnerability Assessment - Identified CVEs and misconfigurations 3. Credential Assessment - Weak password findings 4. Exploitation Proof - Shell access documentation Core Workflow Phase 1: WordPress Discovery Identify WordPress installations: Key WordPress files and directories: /wp-admin/ - Admin dashboard /wp-login.php - Login page /wp-content/ - Themes, plugins, uploads /wp-includes/ - Core files /xmlrpc.php - XML-RPC interface /wp-config.php - Configuration (not accessible if secure) /readme.html - Version information Phase 2: Basic WPScan Enumeration Comprehensive WordPress scanning with WPScan: Phase 3: WordPress Version Detection Identify WordPress version: Version sources: Meta generator tag in HTML readme.html file RSS/Atom feeds JavaScript/CSS file versions Phase 4: Theme Enumeration Identify installed themes: Theme vulnerability checks: Phase 5: Plugin Enumeration Identify installed plugins: Common vulnerable plugins to check: Phase 6: User Enumeration Discover WordPress users: Phase 7: Comprehensive Enumeration Run all enumeration modules: Phase 8: Password Attacks Brute-force WordPress credentials: Password attack methods: wp-login - Standard login form xmlrpc - XML-RPC multicall (faster) xmlrpc-multicall - Multiple passwords p …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills davila7/wordpress-penetration-testing