Exposed WordPress admin logins and password spraying
The short version: A WordPress administrator login (/wp-login.php, /wp-admin/) is exposed by design and lives at a predictable address, making it an easy target for attackers spraying common and breached passwords until one works.
What you need to know
There's no CVE here — this is about the admin login and the passwords behind it. WordPress powers a huge share of the web, and its admin portal lives at the same well-known path on nearly every install. Attackers don't need to find it; they already know where it is, and automated tools spray credentials against WordPress logins at internet scale around the clock.
- How they find it — the admin login path is standardized, so discovery is trivial for any WordPress site.
- How they use it — automated spraying with common and previously-breached passwords, often targeting predictable usernames like
admin. - What it leads to — one valid administrator credential means full control of the site: content, user accounts, plugins, and the ability to plant malware or redirect visitors.
How serious we see it
Moderate. A WordPress admin login protected by strong, unique credentials and enforced MFA is a routine, defensible exposure. The risk rises because the portal is universally known and constantly sprayed — so a weak or reused admin password, with no second factor, is a direct route to full site takeover. It's entirely in your hands to fix, with no vendor patch required.
What to do
- Enforce MFA on every administrator account — the single highest-value control against spraying.
- Avoid predictable admin usernames — don't leave a default
adminaccount in place. - Kill weak and reused passwords — enforce strong, unique credentials and check them against known-breached lists.
- Rate-limit and monitor the login — throttle attempts and alert on spray patterns; consider a plugin or WAF that limits login attempts.
- Confirm your exposure first — verify which WordPress admin logins are reachable from the internet today.
How BreachRisk sees it
BreachRisk discovers exposed WordPress admin portals the way an attacker would — by crawling your external footprint — and then, where authorized, goes a step further than a scanner: it safely attempts a bounded, rate-limited authentication check using exposed (breach-corpus) and common credentials, within strict non-disruptive limits rather than a brute-force flood. That's the honest difference between detecting the admin login and demonstrating whether it actually holds.