You fingerprinted a target and the answer came back: WordPress. That single word should change your plan. WordPress powers something like two in five of all websites, which makes it a giant, uniform attack surface — and the moment you recognise it, the right move is to put down the generic scanner and pick up a CMS-specific one. (A CMS, or Content Management System, is a ready-made platform for running a website without writing all the code from scratch — WordPress, Joomla, and Drupal are the most common examples.)
The crucial insight is where the risk lives. The WordPress core is mature, audited, and patched quickly. The danger is almost always the plugins and themes — the sprawling third-party add-on ecosystem written by independent authors of every skill level, much of it abandoned. Each add-on is code running inside the site, with its own release cadence and its own bugs. That layer is where the exploitable vulnerabilities concentrate, and inventorying it is exactly what WPScan is built to do.
Scope warning. WPScan is active. Enumeration sends many requests the target logs, and its password mode actively guesses credentials against a live login. Run it only against a WordPress instance you own (e.g. a local one in Docker) or a target covered by a signed scope or in-scope bug-bounty asset. This is the unchanging rule from the ethics and authorization lesson.
About the practical. The bundled NovaCart is not WordPress, so there is nothing here to scan inside the course app. Treat this as concept plus an authorised-target walkthrough: stand up a throwaway WordPress in Docker, or use a lab/authorised WP site, and follow the commands there. If you have no WordPress to hand, follow the commands closely so you can recognise them. If Docker is new to you, complete testing-lab-docker-kali first — it covers installation and basic container commands, and running a WordPress image is a one-liner once Docker is in place.In this lesson you will:
- See why CMS platforms concentrate risk in plugins and themes, not the core.
- Drive WPScan's **
--enumerate** modes to find vulnerable plugins (vp), vulnerable themes (vt), and users (u). - Understand the WPScan Vulnerability Database and the free **
--api-token** that turns a detected version into a named CVE. - See how an enumerated username feeds an online password attack (Hydra, next-but-one lesson) and a vulnerable plugin version feeds searchsploit / Exploit-DB.
- Learn the fix — patch, minimise plugins, harden logins — and how the pattern generalises to other CMS scanners (
droopescan,joomscan).
Prerequisites: nikto-whatweb-server-scanning (web server fingerprinting that identifies the CMS type and triggers the need for a CMS-specific scanner).
Estimated time: ten to twelve minutes.
When you are ready, send the Continue signal.