For an application scoped assessment, I would begin with the obvious tools that are specific to that application, such as WPScan (which you mentioned). Beyond the findings there, I would look at your goals, objectives, access, and likelihood of finding types of vulnerabilities.
- Wordpress core is relatively well hardened today. It's unlikely you'll have findings there.
- Wordpress plugins are a potential cesspool. Many of them have no maintenance and were written by people as one of their first programming projects. Look at the interfaces these provide.
- Custom themes, since they can contain PHP, are particularly a source of vulnerabilities, including XSS. Look closely if your friend has a custom theme.
I would use mostly Burp Suite in the evaluation of these areas. If you have reason to believe SQLi exists, then consider also sqlmap.
I wouldn't bother trying to brute force credentials at all -- what's the point? If you want to check whether passwords are strong, you could dump the password database and do an offline attack with JTR or Hashcat, but if the number of users is small, just make them have good passwords. :)
