domains / families / security / cors-credential-wordpress

cors-credential-wordpress

separate

Exploit WP CORS credential reflection for data theft.

When to use

• After `wp-mass-recon` flags a target with `Access-Control-Allow-Credentials: true`.
• Testing any WordPress site's REST API for cross-origin data access.
• Building attack chains: CORS → user enumeration → spear-phishing → ATO.
• Validating whether a CORS finding is exploitable (not just present).

When not to use

• Tasks not involving WordPress REST API CORS misconfiguration

Skill page

Source