Default .htaccess File

This is the current default WordPress .htaccess file (taken from a 5.1.1 version). Currently, as of what I know, there are no vulnerabilities with this code. Note the 4 commented out lines at the bottom. The lines may be enabled or edited by the admin. If these 4 lines have a hashtag and are untouched by an admin, this means that these lines are not enforced.

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

#php_value upload_max_filesize 64M
#php_value post_max_size 64M
#php_value max_execution_time 300
#php_value max_input_time 300

WPengine Hosted Instance

If you see a WPengine header anywhere, it's hosted on WPengine's website and therefore may have a secondary domain name. This could potentially bypass a WAF in some instances:

X-Powered-By: WP Engine

After crawling and clicking throught he application, search for wpengine and a link to it may be exposed within the source of the application.

https://<instance_name>.wpengine.com/

Plugin Source Code Review

To observe the source code of a plugin registered within WordPress plugin-store. Even if the plugin is technically "closed source" because the vendor never shared it on GitHub and is a payed software. See the following link:

https://plugins.trac.wordpress.org/browser/<PLUGIN>/