# WordPress Enumeration

> Enumerate WordPress installations by identifying versions, plugins, themes, and users via WPScan, manual probing, and API endpoints.

- **URL:** https://hackindex.io/services/web/enumeration/wordpress-enumeration
- **Path:** HTTP/HTTPS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/web/enumeration.md)
- **Published:** 2026-01-23
- **Updated:** 2026-08-11

WordPress enumeration maps the installed version, active plugins, themes, and user accounts. Outdated plugins are the most common path to exploitation on WordPress targets. Run this after [tech fingerprinting](https://hackindex.io/services/web/enumeration/http-tech-fingerprinting) confirms WordPress. Vulnerabilities discovered here feed into [WordPress exploitation](https://hackindex.io/services/web/exploitation/wordpress-exploitation).

Priority enumeration targets on a WordPress install:

- Core version from the generator meta tag and /readme.html
- Installed plugins and their versions via readme.txt files
- Active theme and child theme identification
- User accounts through author archives and the REST API
- XML-RPC availability for brute force amplification
- Exposed configuration backups (wp-config.php.bak, .swp, ~)

## Confirm WordPress and Version

Before running wpscan, quickly confirm the install and get a version hint from the generator meta tag or readme:

```bash
curl -sk http://$TARGET_IP:$PORT/ | grep -i 'wordpress\|wp-content\|wp-includes'
# <meta name="generator" content="WordPress 5.9" />
```

```bash
curl -sk http://$TARGET_IP:$PORT/readme.html | grep -i 'version'
```

## wpscan Full Enumeration

wpscan is the primary tool. A full passive enumeration of plugins, themes, and users without authentication:

```bash
wpscan --url http://$TARGET_IP:$PORT/ --enumerate p,t,u --plugins-detection passive
```

Aggressive detection hits more plugins but generates significantly more traffic:

```bash
wpscan --url http://$TARGET_IP:$PORT/ --enumerate p,t,u --plugins-detection aggressive
```

With a WPScan API token, vulnerability data is included inline with results:

```bash
wpscan --url http://$TARGET_IP:$PORT/ --enumerate p,t,u --api-token YOUR_TOKEN --plugins-detection aggressive
```

## User Enumeration

WordPress leaks usernames through the author archive and REST API by default:

```bash
curl -sk http://$TARGET_IP:$PORT/?author=1 -I | grep -i location
# Location: http://10.10.10.50/author/admin/
```

```bash
curl -sk http://$TARGET_IP:$PORT/wp-json/wp/v2/users | python3 -m json.tool
# [{"id":1,"name":"admin","slug":"admin"},{"id":2,"name":"editor","slug":"editor"}]
```

Enumerate IDs sequentially to collect all users:

```bash
for i in $(seq 1 10); do curl -sk http://$TARGET_IP:$PORT/?author=$i -I | grep -i location; done
```

## Plugin and Theme Version Checks

Once you have a plugin list, check individual plugin readmes for version disclosure:

```bash
curl -sk http://$TARGET_IP:$PORT/wp-content/plugins/PLUGIN_NAME/readme.txt | grep -i 'stable tag\|version'
# Stable tag: 3.2.1
```

## Exposed Files and Configuration

Check for commonly exposed WordPress files that reveal configuration or enable further enumeration:

```bash
curl -sk http://$TARGET_IP:$PORT/wp-config.php.bak
curl -sk http://$TARGET_IP:$PORT/wp-config.php~
curl -sk http://$TARGET_IP:$PORT/.wp-config.php.swp
```

```bash
curl -sk http://$TARGET_IP:$PORT/wp-cron.php
```

## XML-RPC Check

XML-RPC is a legacy interface that enables brute force amplification and can be abused for credential stuffing. Check if it's active:

```bash
curl -sk http://$TARGET_IP:$PORT/xmlrpc.php -d "<methodCall><methodName>system.listMethods</methodName></methodCall>"
# <value><string>system.multicall</string></value>
```

system.multicall being available confirms XML-RPC is active and allows brute force amplification: multiple login attempts per HTTP request. This significantly speeds up credential attacks against the WordPress login.

Take enumeration results to [WordPress exploitation](https://hackindex.io/services/web/exploitation/wordpress-exploitation) for credential attacks, plugin exploitation, and theme editor abuse.

## References

- [WPScan](https://github.com/wpscanteam/wpscan) - Plugin detection modes, enumeration flags, and API token usage
- [WPScan Vulnerability Database](https://wpscan.com/vulnerability-database) - WordPress plugin and theme CVE database