If the meta tag has been disabled, check for the presence of /readme.html from root of the install. From the source HTML: Version in readme.html This example is taken from the source of a default WP install of version 3.5.2 and twenty twelve theme. Meta GeneratorĬheck the HTML source of the page for a meta generator tag in the HEAD section of the HTML source. Three simple methods can be used to determine the core version of WordPress. Determining whether the site is running the latest WordPress core version is a good start. To begin with, we want to get an idea of how well maintained the site is. Or it can be performed more aggressively by brute forcing web paths to detect the presence of plugins and themes. This will help us when we move onto the actual attacking or exploitation phase.Įnumeration or reconnaissance can be conducted stealthily using regular web requests to gather technical information about the site. The first thing we want to do is discover as much technical information regarding the site configuration as we can. Ready to start? Let's grab our hoodie and start hacking. If you are self hosting, then security and maintenance are your responsibility. Keep in mind, in a managed WordPress hosting service, some of these attacks (and mitigations) will be the responsibility of the hosting provider. To get started securing a WordPress install, try the excellent guide on or this comprehensive guide on the OWASP site. This article does not intend to repeat those. There are very good guides on securing a WordPress installation available. This popularity makes it a target for bad guys aiming to use a compromised web server for malicious purposes.īy providing details of attack techniques we aim to raise awareness about the need for good maintenance and security monitoring of WordPress. The number of installs continues to grow there are now an estimated 75 million WordPress sites. Its ease of use and open source base are what make it such a popular solution. WordPress is the application behind more than 30% of all websites.

Wpbakery visual composer download 4.1.2