The rear bumper is held on by (4) Phillips head screws in the wheel well, (White Arrows), (2) Stainless Steel Metal Rivets at the rear corners underneath the bumper, (Blue Arrows),  by the (2) step pads, and the round bumper hitch plug cover. Remove the two screws from each side in the rear wheel well, Next remove the step pads by prying them up gently, they are in there pretty stout, I used a flat blade scraper/putty knife wrapped in masking tape to prevent scratching the bumped cladding, broke the scraper and had to resort to using a wide bladed flat head screwdriver with a cloth under it, Next comes the two metal rivets, these are difficult, I had to cut them off with a Dremel tool. Remove the hitch hole plug cover by prying upwards. When the bumper cover is loose, open the cover at the wheel well sides and slide it back a little bit, the License Plate illuminators are still attached, you can get enough room to reach down between the bumper and the plastic supports and twist the bulb sockets, they will come right out. The Illuminator housings will still be attached, you can remove them if needed by pressing the tabs from the inside and pushing the Lamp housing outwards.   One note on the rivets... the actual rivets are made out of stainless, I tried to drill it out, but eventually it just spins in the hole, plus it gets hot when trying to drill it out, so hot in fact that the actual bumper cover material starts to melt around the rivet, so when it got hot, I just pulled the cover down, and after the cover was removed, I went back and used my Dremel to cut the rivet off. I even tried using vice grips to hold the rivet so I could finish drilling it out, but the actual black bumper that is underneath the cover is plastic as well, and it melted the same way. I just pulled the rivet out and will use stainless bolts and nuts to refasten it. The fasteners on the step pads are unreachable from underneath the bumper, so I don't think you can get any squeezing in on the retaining tabs... when I removed my pads, I actually broke off a couple of the retaining tabs, they will still work, but I got plans to reorder another set.   Installation is the reverse of the removal procedures.

Bumper Cover mounting points Stainless Rivet location Rear Bumper Cover removed Stainless Steel rivets