Depending on whether you're the attacker or the site owner, from the
site owner perspective there's a lot of tools and even free plugins you can install that will simply scan your site for vulnerabilities and/or malware depending on what you're looking for. For a lot of my client sites, I use "Hide My WP Ghost" which essentially allows you to rewrite every single WordPress path, your content folders, even API endpoints. That plugin has a "vulnerability scanner" that will sweep the site(s) real quick and notify you of any vulnerabilities in either the site, plugins, and what you can do to increase security (like disabling WP plugin and theme editor, for example).
WPHive (
https://wphive.com/) is another good asset to use for making plugin decisions, it's almost like a "CarFax" for plugins - I believe they also have a browser plugin that when you're browsing WordPress directory for plugins or themes will notify you if the plugin has had any exploits or vulnerabilities recently, when it was, and whether or not it's being fixed or addressed. WPHive also gives detailed history on plugins, so for example WPHive would show multiple instances in which Jetpack has been exploited or risky to use because of severe vulnerabilities.
Then from the
attacker perspective, pretty basic but:
Using a plugin detector and from the list of discovered plugins finding which still have exploitable vulnerabilities, is also another route. In some cases they're even documented or have an exact identifier of what type of exploit or vulnerability it is, narrowing it down. Of course something like this only works until a plugin is patched or updated, but even massive plugins like Jetpack are known to be common focus for attackers as it's basically shovel-ware in the sense Jetpack plugins are pushed with almost every mainstream WordPress hosting platform resulting in majority of WordPress sites opting in and using Jetpack.
Another wonderful, tried and true method of getting into WordPress sites is simply just bruteforcing the /wp-login.php page. It's crazy even nowadays how little security some WordPress sites considering there are even FREE security alternatives and then assets like ChatGPT which can help you rewrite common paths, secure and harden a website in step-by-step form if you had no clue how.In fact, you can even get ChatGPT to write you a small script you can paste into your browser's console (in Dev Tools, CTRL + F12) with a list of words (or even STRINGS) which you can execute a basic bruteforcing attack directly from your browser within only minutes (obviously, you'd want to perform this in a much more organized matter and with an established password list) but because a lot of these sites don't have bruteforce protection, this makes it still a susceptible method of obtaining backend access.
Then obviously the other worthy mentions from the other members, hope that helps.
