WordPress is the most-attacked CMS because it's huge and homogeneous - one plugin flaw hits thousands of sites via automation. The crucial point: the core is relatively secure; the risk lives in third-party plugins and themes of variable quality, made worse by outdated/abandoned plugins, weak admin passwords, and default configs. Common paths: vulnerable-plugin SQLi/XSS/file upload/auth bypass, user enumeration + brute force. A WordPress pentest enumerates versions/plugins/themes for known CVEs, tests the login and enumeration, and manually tests custom plugins, config and hosting - where the worst issues hide. Hardening = minimise plugins, patch promptly, MFA + strong admin creds, least privilege, secure file perms, then test. Detail below; it runs as a scoped web app test.
// 01 Why WordPress is the biggest target
WordPress powers a very large share of the world's websites, and that ubiquity is precisely what makes it dangerous. It's an enormous, homogeneous target: an attacker who finds a flaw in a popular plugin can exploit it across thousands of sites automatically, with no manual effort per victim. The economics favour the attacker completely. So WordPress is relentlessly hit by automated attacks - scanning for known-vulnerable plugins, brute-forcing logins, defacing sites, injecting spam and SEO poisoning, and using compromised sites to host malware or serve as botnet nodes. For a business, a compromised WordPress site isn't just downtime - it can mean a data breach, a blacklisted domain, and reputational damage. And because it's your public front door, it's often the first thing an attacker probes.
// 02 The core is fine - the plugins aren't
Here's the insight that reframes WordPress security: the WordPress core is relatively well maintained and secure. Its power - and its risk - comes from a vast ecosystem of third-party plugins and themes of highly variable quality, written by many developers to many standards. The overwhelming majority of WordPress vulnerabilities come from plugins and themes, not the core. A single vulnerable plugin - especially a popular one - can expose a site to SQL injection, cross-site scripting, file upload flaws or authentication bypass. Sites that install many plugins, fail to update them, or run abandoned plugins (no longer patched) accumulate risk fast. So the real security work isn't “keep WordPress updated” (necessary but not sufficient) - it's managing the plugin and theme attack surface: minimising it, patching it, and testing it. That's the mental shift that actually secures WordPress.
// 03 How a WordPress penetration test works
Enumerate
Identify the WordPress version, installed plugins/themes and their versions to flag known vulnerabilities.
Login & users
Test user enumeration, weak credentials, and brute-force protection on the login and XML-RPC.
Plugin/theme flaws
Examine plugins and themes for exploitable injection, upload and access-control issues.
Config & custom code
Check configuration, file permissions, custom plugins and the hosting environment - where the worst issues hide.
It combines automated identification of known plugin CVEs with manual testing of the site's custom code and configuration - because the highest-impact issues are frequently in a bespoke plugin or a misconfiguration, not a catalogued vulnerability a tool would list. That manual layer is what separates a real test from a scan.
// 04 How to harden WordPress properly
Hardening follows directly from the plugin insight: reduce and maintain the attack surface, and lock down access. Plugins/themes: keep the core, plugins and themes updated promptly; remove anything unused or abandoned; install only from reputable sources and minimise the number - every plugin is attack surface you're choosing to accept. Access: enforce strong admin passwords and MFA, limit login attempts, and change the default admin username. Configuration: apply least privilege to user roles, secure file permissions, disable dashboard file editing, and keep the hosting environment patched. Add regular backups and a WAF for resilience. And crucially, test periodically - a penetration test validates that the hardening actually holds against an attacker, catching the vulnerable plugin or misconfiguration you missed. For a business-critical WordPress site, that combination of disciplined hardening plus regular testing is what keeps you off the automated-victim list. It runs as a scoped web application test, per our methodology.
// 05 Frequently asked questions
Why is WordPress so heavily attacked?
It powers a large share of the web, making it a huge, homogeneous target - a flaw in a popular plugin can be exploited across thousands of sites automatically. The core is relatively secure, but the vast ecosystem of third-party plugins and themes of variable quality is where most vulnerabilities live. Combined with outdated plugins, weak admin passwords and default configs, it's a favourite for automated attacks, defacement and malware hosting.
Where do most WordPress vulnerabilities come from?
Plugins and themes, not the core. Third-party plugins are written to varying security standards, and a single vulnerable one - especially a popular one - can expose a site to SQL injection, XSS, file upload flaws or auth bypass. Sites with many plugins, slow updates, or abandoned plugins accumulate risk fast. The real work is managing the plugin and theme attack surface: minimise, patch, test.
How does a WordPress pentest work?
It assesses the site like an attacker: enumerating the WordPress version, plugins and themes and their versions for known vulnerabilities; testing user enumeration and the login for weak credentials and brute-force protection; examining plugins and themes for exploitable flaws; and checking configuration, file permissions, custom code and hosting. It combines automated identification of known plugin CVEs with manual testing of the site's custom code and configuration, where the worst issues hide.
How do you harden a WordPress site?
Reduce and maintain the plugin/theme surface and lock down access: update core, plugins and themes promptly and remove unused or abandoned ones; install only from reputable sources and minimise numbers. Enforce strong admin passwords and MFA, limit login attempts, change default usernames. Apply least privilege, secure file permissions, disable dashboard file editing, patch hosting. Add backups and a WAF, and test periodically to validate the hardening holds.
// 06 Related reading
- File upload vulnerabilities and access-control flaws — common plugin bugs.
- Manual vs automated testing and OWASP Top 10 in practice.
- Web application penetration testing and our methodology.