Remotely identify the version of a WordPress installation?

3 comments

1. I’m just assuming here but this is usually done by fingerprinting for specific version files/directory’s/code and sometimes even size.

   For example you can remove all the meta versions tags ( isn’t there like 12 places) and .txt file for 3.1 but since 3.1 is the only version to include the following new file by default, it is rather easy to fingerprint.

   wp-includes/js/l10n.js
   

   Since each release has many new additions, if you spend enough time writing a smart bot, it not very hard to find release specific data. Hiding all this info would be a lot of work for every release.

   Log in to Reply

2. This is a bit of code I wrote a while back to do WP version detection in the most obvious ways: http://ottodestruct.com/class-wp-detection.phps

   There are other methods, more subtle and less obvious. His method is file fingerprinting. Basically checking for whether certain files exist or not.

   Log in to Reply

3. I know there’s already been an accepted answer, but just throwing this out there. The way I do it is parse out the $wp_version variable from your blog dir’s ‘wp-includes/version.php’ file:

   function get_wp_version() {
    $versionFile = ABS_PATH.'/wp-includes/version.php'
    // NO VERSION FILE //
    if (($versionStr = @file_get_contents($versionFile))=='') return ''; 
   
    $regex = "wp_version.*'(?<wpVersion>.*)'";
    if (preg_match('/'.$regex.'/', $versionStr, $matches)) {
     return $matches['wpVersion'];
    }
    return '';
   }
   

   Log in to Reply