hunt-wordpress

WordPress Security Assessment

Map WordPress core, REST, XML-RPC, plugins, themes, authentication boundaries, and adjacent installations before selecting a vulnerability-specific test. WordPress presence, a public route, or a version match is not a finding by itself.

When to Use

• HTML, headers, assets, cookies, or routes identify WordPress.
• /wp-json/, /wp-login.php, /xmlrpc.php, or /wp-content/ is reachable.
• JavaScript or source code references a WordPress backend.
• A staging or subdirectory installation may differ from the main site.

Prerequisites

• Explicit authorization and current target boundaries.
• curl and jq; wpscan is optional.
• Approved test identities for role or authorization checks.
• A controlled callback service only when blind SSRF testing is authorized.
• Explicit approval immediately before registration, upload, password, plugin, or other state-changing tests.

How to Run

Begin with a bounded, read-only map:

TARGET="https://www.example.test"
OUTPUT_DIR="${OUTPUT_DIR:-./output/wordpress}"
mkdir -p "$OUTPUT_DIR"

for path in \
  / \
  /wp-json/ \
  /wp-login.php \
  /xmlrpc.php \
  /readme.html \
  /author-sitemap.xml; do
  curl -sS --max-time 10 \
    -o /dev/null \
    -w '%{http_code} %{content_type} %{size_download} %{url_effective}\n' \
    "$TARGET$path"
  sleep 1
done

Procedure

1. Confirm WordPress

Use multiple signals:

curl -sS --max-time 10 "$TARGET/" \
  | grep -Eio 'wp-content|wp-includes|wp-json|wordpress' \
  | sort -u

curl -sS --max-time 10 "$TARGET/wp-json/" \
  -o "$OUTPUT_DIR/rest-index.json"

jq -r '.namespaces[]? // empty' "$OUTPUT_DIR/rest-index.json" \
  | sort -u \
  > "$OUTPUT_DIR/rest-namespaces.txt"

A generic 200 response is insufficient. Compare suspicious paths with a random nonexistent path to detect catch-all routing.

2. Map Core, Theme, and Plugin Assets

curl -sS --max-time 10 "$TARGET/" \
  | grep -Eo "wp-content/(plugins|themes)/[^/?\"']+" \
  | sort -u \
  > "$OUTPUT_DIR/components.txt"