wp-plugin-automation

What problem does it solve?

Manually auditing large lists of WordPress domains for vulnerable plugins and matching them against known CVEs is extremely time-consuming for penetration testers and red teamers. This skill eliminates that manual effort by automating the entire workflow from plugin detection to exploitation proof-of-concept generation for batch target lists.

Core Features & Use Cases

• Automated Plugin Detection: Extracts plugin versions from readme.txt files and REST API namespaces across hundreds of WordPress domains in bulk.
• Curated CVE Matching: Matches detected plugin versions against a pre-built matrix of high-impact vulnerabilities for popular plugins like Revslider, ElementsKit, Gravity Forms, and Jetpack.
• Bulk Misconfiguration Scanning: Checks for common WordPress security flaws including CORS credential reflection, active XMLRPC, exposed debug logs, and open registration across all targets.
• Use Case: A pentester with a list of 100 confirmed WordPress client sites can use this skill to quickly identify which sites have outdated, vulnerable plugins and generate step-by-step exploitation PoCs for the highest-risk findings.

Quick Start

Use the wp-plugin-automation skill to scan your list of confirmed WordPress domains, identify outdated plugins with known CVEs, and generate exploitation proof-of-concept steps for vulnerable targets.