orbit-ajax-fuzzer

Fuzz-testing WordPress AJAX endpoints involves simulating attacks on admin-ajax.php actions with malformed payloads and missing nonces to verify security checks. This Skill automates that process to expose vulnerabilities in plugin AJAX handlers.

WordPress AJAX endpoint scanning is the process of discovering all `wp_ajax_*` and `wp_ajax_nopriv_*` actions within a plugin. It identifies registered AJAX handlers so they can be targeted for security vulnerability testing.

Testing WordPress plugin AJAX handlers for missing nonce checks requires sending requests to admin-ajax.php without valid nonces. This Skill automates fuzz testing to verify if capability checks and nonces are properly enforced.

Yes, you can run AJAX fuzz testing locally by configuring the script with your local WordPress test URL and plugin slug. The Skill operates via a bash script requiring environment variables like `WP_TEST_URL` and `PLUGIN_SLUG`.

Security audits on WordPress AJAX endpoints should be performed after adding new AJAX handlers to a plugin. This fuzz testing ensures newly registered `wp_ajax_*` and `wp_ajax_nopriv_*` actions are secure against common threats.

Verifying capability checks in WordPress AJAX actions involves fuzz-testing admin-ajax.php endpoints with simulated attacks. This Skill automates sending malformed payloads to confirm that proper authentication and authorization are enforced.