Craft CMS Penetration Testing
Craft’s allowAdminChanges setting defaults to true, so a compromised admin account can rewrite permissions and settings straight from the control panel. We test your groups, plugins, GraphQL schema and Twig templates. CREST-certified testers, fixed price from £2,540 for a 2-day single-platform scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Craft’s allowAdminChanges setting ships set to true, so every admin account can change permissions, project config and plugin settings in any environment until you switch it off yourself.
Why Craft CMS security depends on the settings you leave on
Craft splits control panel access into User Groups and individual permission overrides, and admin accounts can do everything in the system, including things with no permission of their own, such as changing every setting and making other users admins. Craft’s own documentation confirms allowAdminChanges defaults to true, so that reach stays available in every environment, production included, until someone switches it off deliberately. We test what each group, each individual override and the admin role itself can actually reach.
Outside the control panel, Craft’s GraphQL API runs on a single public schema, disabled by default, plus any number of private schemas, each guarded by its own bearer token, and a token for a schema that allows mutations carries the same reach as a user with the equivalent permissions. The same shape of risk shows up in preview links: a Preview Target or Share URL carries a token that hands back whatever draft or unpublished entry it was created to preview, wherever a decoupled front end reads that token from. We test what each schema and each preview token actually exposes, not just what its name suggests.
Plugins and custom modules run with the same trust as Craft core once installed, so a plugin left switched on, an overridden controller or a Twig template that renders user input directly can undo the access control the groups and schemas above are meant to enforce. Craft’s own security guidance warns against ever outputting front-end user input with the raw filter or compiling it as Twig, and separately flags that Twig permissions handed to the wrong user group can be used for permission escalation. We test the plugins, custom code and front-end forms you have added, alongside devMode, your securityKey and the volumes your assets upload into, for exactly that kind of drift.
SCOPE
What we pen test on a Craft CMS site
Control Panel User Groups and Permissions
Every permission in Craft, control panel access, section editing, user administration, can be granted directly to a user or additively through User Groups, and a user in more than one group keeps the combined permissions of all of them. Removing someone from one group does not touch what any other group they belong to still grants them, so we test what every group and every individual override actually adds up to.
Admin Accounts and allowAdminChanges in Production
Admin users can do everything in Craft, including things with no permission of their own, such as changing every setting and making other users admins, and allowAdminChanges ships set to true so that reach is available in every environment until someone switches it off. We test whether production has been locked down and what an admin session, compromised or not, can still change if it has not.
Plugins and Third-Party Code
Every installed plugin’s control panel screens sit behind their own accessPlugin permission, so only groups you have explicitly granted that permission can reach them, but a plugin’s own code still runs with the same trust as Craft core once it is installed. We review what each plugin is licensed to do, what it can reach once running, and whether the Plugin Store is genuinely locked down the way allowAdminChanges is meant to lock it in production.
GraphQL Schemas and Token Scope
Craft ships with a single public schema for unauthenticated GraphQL requests, disabled by default, alongside any number of private schemas each gated by its own bearer token, and a token for a schema that allows mutations carries the same reach as a user with the equivalent permissions. We test what the public schema exposes if it has been switched on and whether every private schema’s content and mutation settings match what its token was actually issued for.
Asset Uploads and Volumes
Assets sit in volumes on top of a filesystem, each with its own permissions and a Base URL setting that decides whether Craft generates public links to what has been uploaded. We test upload validation, which volumes are meant to stay private, and whether a volume that should not have public URLs is actually configured that way.
Preview Links and Tokens
A Preview Target or Share URL carries a token that hands back whatever draft or unpublished entry it was created to preview, including on a decoupled front end that reads the token from the query string. We test how long a preview token stays valid, what it actually exposes, and what happens if a link built for one colleague ends up somewhere public.
devMode and Security-Related General Config
devMode is meant for local development only and defaults to false, and settings like securityKey, the private key Craft uses to hash and encrypt data including session cookies, are meant to come from environment variables rather than a committed config file. We check that devMode is off in production, that securityKey and other sensitive settings are not exposed, and how the installed version compares to Craft’s own published security advisories.
Twig Templating and Template Injection
Craft’s own security guidance says never to output front-end user input with the raw filter, incorporate it into object templates, or compile and render it as Twig, and separately warns that Twig permissions handed to the wrong user group can be used for permission escalation. We test every custom template and module for user-supplied content that reaches Twig unescaped, and who in the control panel is trusted with Twig-capable permissions.
Front-End Forms and User Registration
Public registration is disabled by default and, once turned on, new users can be left in a pending state to activate themselves by email or switched to a moderated Deactivate users by default flow, while every POST to a Craft controller action needs a valid CSRF token. We test the registration form and any other front-end forms you run for CSRF coverage, what a newly registered account can reach, and how account activation is actually enforced.
Self-Hosted Craft vs Craft Cloud
Self-hosted, your server, firewall and backups sit in scope alongside the application, its plugins and its configuration. On Craft Cloud, the underlying infrastructure, firewall, DDoS protection and backups are managed for you, so testing concentrates on the roles, tokens, plugins and templates you control.
OUR PROCESS
Craft CMS Penetration Testing: From Scope to Attestation
Scope and Permission Mapping
We agree the environments, accounts and roles in scope, and map every user group, plugin, GraphQL schema and preview token in the instance before testing begins.
Automated and Role-Based Scanning
Authenticated and unauthenticated scanning across every user group and GraphQL schema, plus targeted checks against known Craft configuration weaknesses.
Manual Exploitation
A CREST-certified tester manually tests permission boundaries, token scope, Twig template output and plugin logic, chaining findings where they compound.
Reporting and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Craft CMS pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Craft CMS Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Craft CMS For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Craft CMS Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Craft CMS site?
An admin account with a role you control, so we see the same permission structure your team manages day to day, plus at least one lower-permission user group account to test the boundary between them. Where GraphQL is in use, a token for each schema you want covered. Seeing the code behind any custom plugins speeds up coverage, though black-box testing does not depend on it.
Does this touch our live data?
No. We test against a staging environment or a cloned copy of your content wherever one exists. Where only production is available, any check that could affect real data is agreed and scoped in advance, and read-only checks are logged as they happen.
How long does a Craft CMS penetration test take?
A single-platform Craft engagement is scoped at 2 testing days as a starting point, rising with the number of user groups, plugins, GraphQL schemas and sections in play. Reporting and a walkthrough call follow testing, with a free retest once fixes are in.
Is self-hosted Craft tested differently from Craft Cloud?
Yes. Self-hosted, your server, firewall and backups are in scope alongside the application, its plugins and its configuration. On Craft Cloud the underlying infrastructure, firewall, DDoS protection and backups are managed for you, so testing concentrates on your roles, tokens, plugins and templates.
What is out of scope?
The Craft CMS core codebase itself, since Pixel & Tonic runs its own vulnerability disclosure programme for that. Third-party plugins you have not installed, and any infrastructure outside the Craft install, unless you scope a wider cloud or network review alongside it.
Does Craft CMS have a policy for security testing?
Pixel & Tonic, the company behind Craft, runs a public vulnerability disclosure programme for issues in Craft’s own core code, and its security policy states the team is primarily concerned with problems in a fresh Craft installation rather than your front-end implementation, custom plugins or modules, unless a foundational issue is involved. That covers Craft itself, not the roles, plugins, GraphQL schemas and templates you have configured, which is what this engagement tests. Where your site runs on Craft Cloud’s managed infrastructure rather than your own server, we confirm Craft Cloud’s current terms with you during scoping before any testing starts.
Do you test GraphQL as well as the control panel and front end?
Yes, where GraphQL is enabled. The public schema and every private schema and token are tested as their own surface, since each one can expose or mutate content independently of what your control panel permissions and front-end templates already restrict.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Craft CMS site
Craft’s allowAdminChanges setting defaults to true, so a compromised admin account can rewrite permissions and settings straight from the control panel. We test your groups, plugins, GraphQL schema and Twig templates. CREST-certified testers, fixed price from £2,540 for a 2-day single-platform scope, quoted within 24 hours.
