The provisioning of accounts presents an opportunity for an attacker to create a valid account without application of the proper identification and authorization process.
Verify which accounts may provision other accounts and of what type.
Determine which roles are able to provision users and what sort of accounts they can provision.
In WordPress, only a user's name and email address are required to provision the user, as shown below:
De-provisioning of users requires the administrator to select the users to be de-provisioned, select Delete from the dropdown menu (circled) and then applying this action. The administrator is then presented with a dialog box asking what to do with the user's posts (delete or transfer them).
While the most thorough and accurate approach to completing this test is to conduct it manually, HTTP proxy tools could be also useful.