Skip to main content
This page aggregates cross-platform resources to practice WordPress Exploitation: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills. Coverage: 21 challenges across 2 platforms — 13 HackTheBox · 8 TryHackMe. 13 with a Spanish writeup, 13 with a video writeup.

​
Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.
  1. TryHackMe — Bypass Really Simple Security (Easy · ~30 min) · 🇬🇧
  2. TryHackMe — Web Enumeration (Easy · ~40 min) · 🇬🇧
  3. TryHackMe — Web Security Essentials (Easy · ~60 min) · 🇬🇧
  4. TryHackMe — Wordpress: CVE-2021-29447 (Easy · ~45 min) · 🇬🇧
  5. HackTheBox — Backdoor (Fácil) · 🇪🇸 🇬🇧 📹
  6. HackTheBox — Blocky (Fácil) · 🇪🇸 🇬🇧 📹

​
Curated resources

​
HTB machines practicing WordPress Exploitation (13)

​
TryHackMe rooms practicing WordPress Exploitation (8)

← Back to the full glossary Last updated: 2026-08-13