skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

wp-plugin-automation

Automates WordPress vulnerability auditing by extracting plugin versions and matching CVEs from batches of target domains.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration testing#vulnerability detection#wordpress#batch scanning#plugin cve#plugin version extraction#exploitation poc
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill wp-plugin-automation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wp-plugin-automation
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/wp-plugin-automation
Command: npx skills add https://github.com/uphiago/recon-skills --skill wp-plugin-automation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually auditing large lists of WordPress domains for vulnerable plugins and matching them against known CVEs is extremely time-consuming for penetration testers and red teamers. This skill eliminates that manual effort by automating the entire workflow from plugin detection to exploitation proof-of-concept generation for batch target lists.

Core Features & Use Cases

  • Automated Plugin Detection: Extracts plugin versions from readme.txt files and REST API namespaces across hundreds of WordPress domains in bulk.
  • Curated CVE Matching: Matches detected plugin versions against a pre-built matrix of high-impact vulnerabilities for popular plugins like Revslider, ElementsKit, Gravity Forms, and Jetpack.
  • Bulk Misconfiguration Scanning: Checks for common WordPress security flaws including CORS credential reflection, active XMLRPC, exposed debug logs, and open registration across all targets.
  • Use Case: A pentester with a list of 100 confirmed WordPress client sites can use this skill to quickly identify which sites have outdated, vulnerable plugins and generate step-by-step exploitation PoCs for the highest-risk findings.

Quick Start

Use the wp-plugin-automation skill to scan your list of confirmed WordPress domains, identify outdated plugins with known CVEs, and generate exploitation proof-of-concept steps for vulnerable targets.

Frequently Asked Questions about wp-plugin-automation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I batch scan WordPress domains for vulnerable plugins and known CVEs?▼

You can batch scan WordPress domains for vulnerable plugins by automating plugin version extraction from readme.txt files and REST API endpoints, then matching those versions against a curated database of high-impact CVEs to identify exploitable targets.

What is the best way to extract WordPress plugin versions across hundreds of sites for penetration testing?▼

The best way to extract WordPress plugin versions across hundreds of sites is to automate bulk requests targeting readme.txt files and REST API namespaces, enabling rapid detection of outdated plugins for reconnaissance workflows.

Can I scan for WordPress misconfigurations like CORS and XMLRPC in bulk?▼

Yes, you can scan for WordPress misconfigurations in bulk by checking target lists for active XMLRPC, CORS credential reflection, exposed debug logs, and open registration across all confirmed WordPress domains simultaneously.

How does automated plugin CVE matching work for WordPress reconnaissance?▼

Automated plugin CVE matching works by extracting detected plugin versions from WordPress sites and comparing them against a pre-built matrix of high-impact vulnerabilities for popular plugins like Revslider, Gravity Forms, and Jetpack.

Do I need a pre-compiled list of confirmed WordPress sites before batch auditing?▼

Yes, you need a pre-compiled list of confirmed WordPress sites because batch auditing relies on having existing target domains ready to input into the plugin detection and CVE matching workflow.

Can I generate exploitation proof-of-concept steps automatically for identified WordPress plugin vulnerabilities?▼

Yes, you can generate exploitation proof-of-concept steps automatically by identifying outdated plugins with known CVEs during the batch scan and producing step-by-step PoC instructions for the highest-risk findings.

Related Skills

Explore More Software Engineering Skills→
uphiagouphiago
1.1k

wp-plugin-cve-hunt

Identify exploitable WordPress plugin CVEs across target domains via version extraction and database cross-referencing.

Community
Advanced
NITISH-gitbitNITISH-gitbit

web-pentest

Automate web application penetration testing with vulnerability discovery, exploitation, and reporting.

Community
Advanced
uphiagouphiago
1.1k

wordpress-cors-xmlrpc-rce-chain

Chain WordPress CORS, XMLRPC, and open registration misconfigurations into remote code execution.

Community
Advanced
adityaarsharmaadityaarsharma
2

orbit-broken-access-control

Detect and mitigate Broken Access Control vulnerabilities in WordPress plugins.

Community
Advanced