tech-wordpress

Probe WordPress sites for security misconfigurations and information disclosure vulnerabilities.

Updated Jul 30, 2026

Search Tags:#security #vulnerability #audit #wordpress #hardening #pentest

Ready to run

npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill tech-wordpress

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: tech-wordpress
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/tech-wordpress
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill tech-wordpress

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates the security assessment of WordPress installations, identifying common misconfigurations and information disclosure vectors that could be exploited by attackers.

Core Features & Use Cases

Vulnerability Identification: Detects exposed sensitive files like wp-config.php, debug.log, and .htaccess, as well as dangerous legacy endpoints like xmlrpc.php.
Information Disclosure Audit: Scans for REST API user enumeration, plugin/theme version leaks, and directory listing vulnerabilities.
Use Case: Before a security review, use this Skill to quickly map the attack surface of a WordPress site and generate a prioritized hardening checklist.

Quick Start

Use the tech-wordpress skill to perform a read-only security audit of the target site at https://example.com.

Frequently Asked Questions about tech-wordpress

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit a WordPress site for security vulnerabilities and misconfigurations?▼

A WordPress security audit detects exposed sensitive files like wp-config.php, debug.log, and .htaccess, along with dangerous legacy endpoints such as xmlrpc.php. It maps the attack surface by performing read-only HTTP probes to validate administrative panel exposure and REST API security.

How does WordPress REST API user enumeration work during a security assessment?▼

WordPress REST API user enumeration exposes usernames by querying default API endpoints, a common information disclosure vulnerability. Security assessments detect this via read-only HTTP probes to verify if the API leaks valid user data, allowing you to prioritize hardening actions.

Can I use this to check if my WordPress site exposes sensitive files like wp-config.php?▼

Yes, checking if WordPress exposes sensitive files like wp-config.php, debug.log, and .htaccess is a core function of the audit. It performs read-only HTTP probes to identify these information disclosure vectors and generate a prioritized hardening checklist.

Is a read-only WordPress pentest safe to run against a live production environment?▼

A read-only WordPress pentest is designed for live production environments because it sends HTTP probes to validate security configurations without attempting exploits or modifying data. It safely checks administrative panel exposure, REST API status, and legacy endpoint status.

What is the best way to harden a WordPress site after finding xmlrpc.php exposure?▼

The best way to harden WordPress after finding xmlrpc.php exposure is to disable or restrict access to the legacy endpoint. The audit identifies this vulnerability alongside directory listings and plugin version leaks, generating a prioritized checklist to remediate information disclosure risks.