I am looking to dive into learning more about Wordpress vulnerabilities and conducting penetration testing against them. Are there any good "Vulnerable WP Sites?" that I can download as a VM to play around in? Sort of in the same vain as DVWA or Hackazon? An inital search didn't come up with much--and what did seemed to be single vulnerability labs.

Ideally I would like something that's no more than 2-3 years old.


  • In my opinion the best way to do that is to setup your own local wordpress installation and practice with that. You can also download some wp VMs from vulnhub but those will probably be single vulnerability labs. – game0ver Jul 13 '18 at 23:33

Your best bet would be to look at specific vulnerabilities found in the WP Vuln DB

This site has exact application versions of when it was vulnerable, when it was patched and links to references.

You can get older releases of Wordpress off their site here

Also, if you don't have any experience with it, I recommend checking out WPScan which comes stock in Kali and Parrot OS

Anytime I see a wordpress site I run wpscan. It's magical. I also run it against my own blog usually once a month when I poke around my network.

  • This is sort of where I ended up landing as well after further looking into it. I wonder why there hasn't been some kind of VM that hosts a range of vulnerable wordpress plugins/versions/configurations? – Tobin Shields Jul 14 '18 at 16:55
  • 1
    I ask this question a lot about info sec stuff. The answer usually is to many things to do not enough people. Sounds like an opportunity for you to setup a project useful to others. It'd make a cool hacker con presentation also – Anthony Russell Jul 14 '18 at 17:27

Make up a virtual pentesting machine with VirtualBox or VMware. Have the necessary tools installed or use the ones that come with Kali Linux.

For a vulnerable machine with WordPress stack with some plugins to test installed already, you may download one from https://www.turnkeylinux.org/wordpress

The first boot will ask you to setup the IP gateway, Netmask, admin passwords.

Now you can continue pentesting your own vulnerable WordPress install.

Not the answer you're looking for? Browse other questions tagged or ask your own question.