skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-wordpress

Detect critical WordPress vulnerabilities during penetration testing and reconnaissance.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration testing#reconnaissance#cors#wordpress#vulnerability hunting#xmlrpc#plugin cve
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-wordpress
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-wordpress
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-wordpress
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-wordpress

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, curl, python3, nc, timeout, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill eliminates the tedious, error-prone process of manually identifying WordPress-specific vulnerabilities during reconnaissance and penetration testing, where WordPress powers a huge share of web targets and has well-documented, high-impact flaw patterns that are often missed by generic security scanners.

Core Features & Use Cases

  • WordPress Fingerprinting: Detects WordPress installs (including cross-subdirectory instances) via X-Powered-By headers, /wp-content paths, and REST API root responses, plus identifies active plugins and themes.
  • High-Impact Vuln Detection: Tests for the most common critical WordPress flaws including CORS credential reflection on the REST API, XMLRPC-enabled brute force/SSRF/file upload, open registration, exposed debug logs and wp-config backups, and known plugin CVEs.
  • Use Case: A pentester targeting a retail company with 10+ web properties can use this Skill to quickly identify all WordPress instances, test for critical flaws like CORS data exfiltration or XMLRPC RCE, and prioritize exploitation chains without building custom checks from scratch.

Quick Start

Use the hunt-wordpress skill to scan target.com for all critical WordPress vulnerabilities including CORS credential reflection, XMLRPC exploitation, and exposed sensitive files.

Frequently Asked Questions about hunt-wordpress

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect WordPress instances hidden in subdirectories during reconnaissance?▼

WordPress fingerprinting identifies cross-subdirectory instances by checking X-Powered-By headers, /wp-content paths, and REST API root responses to confirm active installations across target web properties.

What is the best way to test for WordPress CORS credential reflection vulnerabilities?▼

Testing for WordPress CORS credential reflection involves probing the REST API for misconfigurations that allow cross-origin data exfiltration, automating detection of these high-impact flaws alongside XMLRPC and plugin CVE checks.

Can I use automated scripts to hunt for known WordPress plugin CVEs at scale?▼

Automated scripts can hunt for known WordPress plugin CVEs at scale by applying field-validated checks to detect critical vulnerabilities like remote code execution across multiple web properties without manual custom check creation.

Does XMLRPC exploitation in WordPress still work for brute force and SSRF attacks?▼

XMLRPC exploitation in WordPress remains viable for brute force, SSRF, and file upload attacks; this Skill tests for XMLRPC-enabled vulnerabilities to identify potential remote code execution and credential theft vectors.

What tools do I need to check for exposed wp-config backups and debug logs?▼

Checking for exposed wp-config backups and debug logs requires standard command-line tools like python3, requests, curl, and nc; this Skill orchestrates these dependencies to automate sensitive file exposure checks.

When should I use specialized WordPress vulnerability hunting over generic security scanners?▼

Specialized WordPress vulnerability hunting should be used over generic security scanners when targeting WordPress-powered web applications, as generic scanners often miss well-documented, high-impact flaw patterns specific to WordPress REST API and XMLRPC configurations.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

source-leak-hunt

Scan multiple domains for exposed sensitive files like .env and .git/config.

Community
Intermediate
ArianHobson333ArianHobson333
7

exploiter-overview

Automate exploit chain construction from validated findings for security testing.

Community
Advanced
bpnrockstarbpnrockstar

hunt-brute-force

Detect missing rate limiting and brute force enumeration vulnerabilities in web applications.

Community
Advanced
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced