I will help a friend to test the security behind their  WordPress site. I thought about to start to do a scan with Burpsuite  and also WPScan, I also believe I will find a acunetix useful.

When I read a lot about the way people is penetration-testing wp-sites a lot of people is using sql injection on older versions of WP, though I believe this site is pretty new.
Also a lot people is using brute-forcing though that builds on you have got a good word-list.

What is your suggestions?

Notice also I am not interested in break their Webserver in a any way.