wordpress-security

CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

Recon & pentest skill pack. CORS, XSS, SQLi, SSRF, RCE, WordPress, MCP, cloud, subdomain takeover, and more. Field-tested. MIT. Full write-up at hiago.sh

WPScan rewritten in Python + some WPSeku ideas

Advanced web security scanner with 49 modules, evasion engine, and CVE database.

WPAUDIT: Advanced WordPress security auditing suite & vulnerability scanner. Automates pentesting with Nmap, WPScan, Nuclei, SQLMap. Comprehensive reports. Ideal for ethical hackers & Kali Linux.

A wordpress security auditor! Audit your wordpress application for security issues with even 1 request.

The battle-tested, all-in-one .htaccess configuration for WordPress. Combines H5BP performance standards, Perishable Press 8G Firewall WAF, and empirical zero-PHP threat intelligence.

Audit, clean, and harden a WordPress site end to end, with an AI agent (Claude/Cursor/Codex/MCP or SSH). Detects & removes hidden malware — cloaking, backdoors, database injection — scores your security posture, and hardens safely. Free, open-source (AGPL-3.0).

25 production-tested defensive security skills for Claude Code - WordPress, VPS, Cloudflare, Next.js hardening, AI agent guardrails, MCP security, prompt injection defense, OWASP LLM Top 10, LLM coding failure modes (slopsquatting, hallucinated APIs, sycophancy), incident response, GDPR/DACH compliance. MIT, battle-tested.

WP2Shell - CVE-2026-63030 / CVE-2026-60137 This tool exploits a critical SQL injection vulnerability in the WordPress REST API `/wp-json/batch/v1` endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries and achieve Remote Code Execution (RCE) on vulnerable WordPress installations.

ICU-WP is a Flask-based WordPress username enumeration tool. It detects WordPress sites and uses methods like author URL checks, REST API queries, and user detail endpoints to find usernames. Ideal for security assessments, this tool supports configurable timeouts and concurrency.

WordPress vulnerability scanner with public exploit/POC lookup, gambling spam (judol) detection, and AI-powered analysis. Scan plugins, themes & core for known CVEs — offline or remote.

Unauthenticated PHP Object Injection to RCE in WP Activity Log <= 5.6.3.1 (CVE-2026-54806)

#1 Open WordPress vulnerability database tracking 27,000+ issues (plugins, themes, core). Updated On Daily Basis. Formats: SQLite, CSV, Excel.

AI-powered automated penetration testing agent. Finds and exploits vulnerabilities in web apps, WordPress, and REST APIs using Claude AI with Tor routing.

Script for bruteforcing multiple Wordpress Users (XMLRPC)

Defensive WordPress security scanner — 189 checks, 8-source nightly CVE aggregator, SLSA L3 + Sigstore-signed releases, 10-provider threat-intel federation, continuous monitoring, active exploit verification (consent-gated), enterprise SSO/RBAC/audit/multi-tenant, distribution to Docker/K8s/Homebrew/Snap/winget/AUR. AGPLv3.

Professional CMS security assessment tool for authorized penetration testing. Supports WordPress, Joomla, and Drupal with passive/active/full scan modes. CMS Recon & Vulnerability Scanner by Saket Pandey

CVE-2026-49772 — The Events Calendar (WordPress) unauthenticated blind SQLi PoC

PoC for the WordPress 6.9/7.0 REST batch-route confusion and author__not_in SQL injection chain.