Testing · by appointment
WordPress penetration testing
Patching is the minimum. A VulnCrest pentest tests your plugins, custom code, access controls and attack chains the way a real adversary would — within an agreed scope, by the same engineers credited with 37+ WordPress plugin CVEs — and hands you risk-rated findings with evidence and fixes.
What you get
- Testing by engineers credited with 37+ WordPress plugin CVEs
- Access control, REST & AJAX, file upload, auth and chained flaws
- Risk-rated findings with reproducible evidence
- Clear fix guidance your developer can act on
What we test
- OWASP A01 / A03
- REST & AJAX endpoints
- File upload handling
- Auth & XML-RPC
- Known plugin CVEs
- Config & secret leaks
- Server & TLS
Questions
How is a pentest different from a plugin scan?
A scanner matches known signatures. A pentest is a specialist actively attacking within an agreed scope — access control, REST API, uploads, custom code and chained flaws a scanner can't find.
What access do you need?
For a black-box test, none. For grey-box testing we agree the accounts and scope in advance. Everything is covered by a signed authorization and NDA.
What do I get at the end?
A written report: each finding risk-rated, with evidence to reproduce it and specific fix guidance, plus a retest of the fixes on request.
Site hacked right now?
Report it and an engineer replies within 30 minutes, day or night.