Audit WordPress Security and Exploit Vulnerabilities

This skill, explicitly scoped to authorized security assessments, defensive validation, or controlled educational environments, covers comprehensive WordPress penetration testing across ten phases: discovery (identifying WordPress via HTML markers, common paths like /wp-admin/ and /xmlrpc.php, and Nmap's WordPress-enum script), WPScan-based enumeration (basic and aggressive detection modes, JSON output, API-token-backed vulnerability data), version detection (meta generator tags, readme.html, RSS feed generator strings), theme and plugin enumeration (all vs. vulnerable-only flags, manual wp-content/themes|plugins/ discovery, cross-referencing findings against searchsploit), user enumeration (WPScan's user module, manual author-ID iteration, the REST API's /wp-json/wp/v2/users endpoint, and login-error-based enumeration), comprehensive multi-module enumeration runs, password attacks (wp-login vs. the faster XML-RPC multicall method, throttling, targeted wordlists built with cewl), exploitation (Metasploit's wp_admin_shell_upload and plugin-specific modules, manual theme/plugin-editor reverse shells, and malicious-plugin-upload webshells), advanced XML-RPC techniques (system.listMethods enumeration, XML-RPC multicall brute-forcing), and proxying/authentication options (Tor, Burp Suite, HTTP basic auth).

It also has a dedicated section testing WordPress 7.0's new attack surfaces, each with concrete probe commands: AI Connector endpoints (/wp-json/ai/v1/) tested for prompt injection by sending adversarial instructions directly to the prompt endpoint; the Abilities API manifest (/wp-json/abilities/v1/manifest) and ability-invocation endpoints tested for permission-boundary bypass; Real-Time Collaboration's sync storage meta and provider endpoints tested for session hijacking and data interception; and DataViews admin-ajax endpoints tested for filter/sort parameter injection, including a SQL-injection-style orderby payload. It frames four categories of new WordPress 7.0 risk: AI prompt injection, collaboration data exposure/session hijacking, Abilities API privilege escalation, and connector credential theft.

Use this skill for authorized WordPress security assessments - user/theme/plugin enumeration, vulnerability scanning, credential attacks, and exploitation validation - including testing the specific new attack surfaces introduced by WordPress 7.0 (AI Connectors, Abilities API, RTC, DataViews). Its legal constraints are explicit and non-negotiable: obtain written authorization before testing, stay within the defined scope, document all testing activities, and follow responsible disclosure for anything found.

It is not for testing systems without explicit authorization, and its own troubleshooting notes acknowledge real-world limits: WAFs may block scanning, rate limiting may defeat brute-force attempts, and XML-RPC may simply be disabled on the target.

Input is an authorized WordPress target to assess. Output is a WordPress enumeration report (version, themes, plugins, users), a vulnerability assessment (CVEs and misconfigurations), a credential assessment (weak passwords found), and exploitation proof (documented shell access) where applicable - plus, for WordPress 7.0 targets, findings on AI prompt injection, Abilities API exposure, RTC data leakage, and DataViews injection points.

wpscan --url http://target.com -e vp,vt,u,cb,dbe --detection-mode aggressive

Built around WPScan (pre-installed in Kali Linux), Metasploit Framework, Burp Suite/OWASP ZAP, Nmap, and searchsploit, targeting WordPress's core architecture (wp-admin, wp-login, wp-content, XML-RPC, REST API) plus WordPress 7.0's new API surfaces.

Authorized penetration testers and security researchers assessing WordPress installations - which power roughly 35% of websites - who need concrete WPScan/Metasploit workflows plus coverage of the newest WordPress 7.0-specific attack surfaces.