search

hashtag
Enumerating WordPress

hashtag
#1 WordPress Core Version Enumeration

Three simple methods can be used to determine the core version of WordPress.

  • Meta Generator

Check the HTML source of the page for a meta generator tag in the HEAD section of the HTML source.

<meta name="generator" content="WordPress 5.2.3" />

  • Version in readme.html

If the meta tag has been disabled, check for the presence of /readme.html from root of the install. Early versions of WordPress had the version right there at the top of the ReadMe file, newer versions of WordPress have removed the version from the file.

hashtag
Version in HTML source of site

In the HTML source, the version is often appended as a parameter on links to javascript and css resources that the page is loading.

Source code showing the version appended as a parameter on links to javascript and css

Depending on the plugin, this will not always be the case, and sites that have minified js and css may not have these information leaks present.

hashtag
#2 WordPress Plugin (and version) Enumeration

During WordPress Plugin Enumeration we attempt to find as many installed plugins as we can (even those that are disabled). Knowing the installed WordPress plugins may allow us to identify the version, and research whether it is vulnerable to known exploits.

In the readme.txt we can see the version of the plugin. Compare this against known exploits and we can get a good idea if the site is vulnerable without actually throwing the exploit.

hashtag
#3 WordPress Theme Enumeration

Enumeration of the theme is conducted similarly to detecting the plugins. The theme path is often visible in the HTML of the page source. The CSS file getting loaded from the theme will often reveal the path.

With the path we have the theme name, and we can load the readme.txt to confirm the theme in use and the version.

Last updated