We attempt to log in to the admin panel using "admin" as both the username and password. The admin panel indicates that the username is incorrect. However, if a valid username is entered with the wrong password, the system simply returns a "wrong password" message. This poses a security risk, as it allows attackers to separately guess the username and password, potentially making it easier to breach the system.
On a related note, since valid usernames can be easily found in public areas like the news section, it is advisable to configure access rights (if not already configured) to ensure that users with visible usernames have the minimal necessary privileges in the admin area. This way, if an attacker manages to guess the password, their access is limited.
In addition, robots.txt reveals that the WP-Optimize plugin is installed, as it creates the file `/wp-content/uploads/wpo-plugins-tables-list.json`, which is also referenced in robots.txt. While this list does not specifically refer to the plugins on this site, its presence is a clear indicator of the installed WP-Optimize plugin, which has a history of security vulnerabilities.