How long does it take to brute force a Wordpress password?
If the password was 8-10 random characters with alphanumerics and some symbols, a lower bound estimate of the entropy would be something like 48 bits (eight random base 64 characters). Coupled with WordPress' weak 8-round MD5, that's just over 50 bits of security. Not terribly secure.

A low-resource attacker like you assume could maybe crack it in a couple of weeks. If they had nothing else to do with their computer. Or they could buy some cloud computing resources to tackle the job. According to this blog post, an Amazon GPU instance (from a couple of years ago) could calculate about two billion MD5 hashes per second. With eight instances you'd have the search space covered in 24 hours. And that costs maybe a hundred bucks if that. (You could also do it quicker with more instances without a significant cost increase.)

However, if you assumed the high end of 10 characters out of all printable ASCII (95 possibilities), you would have a 65 bit strong password. Which would cost more like ten million dollars to brute force. So the actual entropy is rather important. If the initial password wasn't generated with a random number generator, its entropy was probably much less than something like the site you linked would predict.



While it is possible, brute forcing the password sounds like one of the less likely ways a WordPress blog would be compromised. An unpatched vulnerability in WordPress itself, some plugin, PHP, the SQL database or some other software seems more likely. Or in the case or a shared host, even a privilege escalation from another account.