domains / families / security / wordpress-full-compromise

wordpress-full-compromise

separate

Use when verified WordPress findings may combine into an authorized path to administrative or server control.

When to use

• A plugin vulnerability has exact version and route evidence.
• An approved identity may have an unexpected WordPress capability.
• An upload or configuration write could reach executable handling.
• CORS, XML-RPC, staging, or source exposure may supply a missing prerequisite.

When not to use

• forcing escalation after a prerequisite fails
• password spraying
• credential stuffing
• using unrelated leaked credentials
• deploying a command shell as generic proof
• treating open registration as high privilege
• assuming XML-RPC presence implies authorization

Skill page

Source