A WordPress 4.9.5 site on PHP 7.2.5 with an admin account, set up the way secDevLabs describes it. Its login errors, version, directory listings and HTTP headers give away more than they should.
Not startedDockercommit bfc829cx86_64 · aarch64Secret
Find the admin's password through the login page, log in as admin, and list what the outdated WordPress and its configuration expose.
The brief for this lab lives in its repository.