domains / families / security / wordpress-plugin-hunt

wordpress-plugin-hunt

separate

Hunt WP plugins via REST, exploit CVEs when version known.

When to use

• WordPress confirmed on target (via `wp-mass-recon`).
• Running `deep-invade` Phase 3.
• You need an exploitation vector beyond CORS/XMLRPC.
• Target has a plugin-heavy WordPress site (e-commerce, page builder, forms).

When not to use

• Non-WordPress targets
• Targets without confirmed WordPress installation

Skill page

Source