domains / families / security / hunt-wordpress

hunt-wordpress

separate

Use when an authorized target exposes WordPress core, plugin, theme, REST, or XML-RPC behavior.

When to use

• HTML, headers, assets, cookies, or routes identify WordPress.
• `/wp-json/`, `/wp-login.php`, `/xmlrpc.php`, or `/wp-content/` is reachable.
• JavaScript or source code references a WordPress backend.
• A staging or subdirectory installation may differ from the main site.

When not to use

• WordPress presence, a public route, or a version match is not a finding by itself
• A generic 200 response is insufficient
• Header reflection is only a lead
• A status code alone does not prove XML-RPC behavior
• A weaker staging control matters only when the environment is in scope and its impact is demonstrated

Skill page

Source