WordPress
The web's most common content management system.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- AppWordPress
- Framework
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
WordPress runs a large share of the world's websites. It is written in PHP and keeps its posts and settings in a MySQL database, usually on Linux. Apache runs its PHP, or nginx sits in front of PHP-FPM, which does. Most WordPress flaws are found in plugins and themes, the add-ons a site installs, not in the core software.
How to Spot It
These are signs that a system runs WordPress, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Path
/wp-login.php- Path
/wp-content/- Page source
<meta name="generator" content="WordPress 6.5" />- Cookie
wordpress_logged_in_<hash>
If It Has a Flaw
A flaw in WordPress core, a plugin or a theme reaches the whole site and the database behind it. It often reaches the server too, when the account the web server runs as has more rights than it needs.
A flaw exposes the data it keeps.
- Data
MySQL
Stacks and Code
WordPress is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- Its Code Comes From
PackagistWordPress Plugins