Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

wordpress-penetration-testing — Claude Code skill: vulnerability

This skill audits WordPress installations for common vulnerabilities and REST API permission issues in plugins. Designed for authorized security assessments.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add sickn33/agentic-awesome-skills --skill wordpress-penetration-testing -a claude-code
Open on GitHub

What wordpress-penetration-testing does

The skill automates detection of typical WordPress misconfigurations: broken REST API access controls, outdated plugins, weak security settings. It uses WPScan, Metasploit Framework, and Burp Suite for scanning and analysis. Nmap handles initial discovery, cURL runs verification checks.

Before any scan, the skill enforces a confirmation gate: you provide the exact target URL or IP, confirm written authorization from the owner, and the skill displays the command and its effect. Without confirmation, it stays read-only and offers defensive guidance only. It accounts for real constraints: WAF may block traffic, rate limiting slows brute-force attempts, some plugins produce false results.

Agree with the owner on source IPs, request rates, maintenance windows, and stop conditions beforehand. Use throttle to reduce load—for example, --throttle 1000—and do not circumvent agreed limits by switching proxies or authentication channels.

What it helps with

  • find vulnerabilities in WordPress REST API
  • check plugin access control boundaries
  • discover outdated or dangerous extensions
  • assess site security configuration
  • audit a site before going live

Example prompts for the agent

  • Scan example.com for WordPress vulnerabilities
  • Check REST API permissions on example.com, I have owner authorization
  • Find access control issues in the WordPress installation

How to install wordpress-penetration-testing

1Skills CLI (Vercel)

npx skills add sickn33/agentic-awesome-skills --skill wordpress-penetration-testing -a claude-code

2Manually: put the files in place

~/.claude/skills/wordpress-penetration-testing/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/wordpress-penetration-testing/

From the same set80

The whole set →
docker-expert sickn33 A skill that turns your AI agent into a Docker reviewer for Dockerfiles, multi-stage builds and container security. Useful when images and Compose files need a second look. Claude Code CX Codex Cursor +1 27,200installs typescript-expert sickn33 A skill for TypeScript and JavaScript work: it reads your project setup, fixes type errors and speeds up type checking. Useful once a TS codebase gets big. Claude Code CX Codex Cursor +1 12,600installs browser-automation sickn33 This skill builds browser checks around observed UI state and explicit outcomes. Use it for UI workflows, timing failures, or authorised page-data collection. Claude Code CX Codex Cursor +1 6,700installs nextjs-supabase-auth sickn33 This skill wires Supabase Auth into the Next.js App Router with clients, middleware, OAuth callbacks, and Server Actions. Use it when you need protected routes and session handling. Claude Code CX Codex Cursor +1 6,500installs 3d-web-experience sickn33 Helps build and debug web 3D scenes, product configurators, and portfolios. Covers stack choice, model loading, scroll interaction, and performance checks. Claude Code CX Codex Cursor +1 5,200installs prisma-expert sickn33 This skill helps inspect Prisma schemas, migrations, and queries. Use it to investigate an error or review database changes before deployment. Claude Code CX Codex Cursor +1 4,200installs playwright-skill sickn33 Write and run Playwright browser tests directly in Claude Code: responsive design checks, login flows, form submissions, screenshots. Executes locally via Node with a visible browser window. Claude Code CX Codex Cursor +1 3,900installs game-development sickn33 Guides game architecture decisions, platform choices, and core loop structure. Directs the assistant to specialized sub-skills for web, mobile, PC, or VR. Claude Code CX Codex Cursor +1 3,800installs

Similar

pptx-reference-deck-analysis kimtth Reads a PPTX reference deck without changing it, covering structure, theme, typography, layouts, and OOXML. Use it before building a new deck from a reference. Claude Code CX Codex Cursor 2,500installs vibe-security Chris Raroque A skill that audits apps built fast with an AI assistant: leaked keys, broken database access rules, and trust placed in values coming from the client. Claude Code CX Codex Cursor +1 3,600installs mantis-threat-model official google Turns the Mantis knowledge base into a project threat model: trust boundaries, entry points, attacker profiles. Useful once the architecture is written down but the threat model is not. Claude Code CX Codex Cursor +1 1,800installs sign-in-with-google-web official google Guides Google Identity Services setup across web projects. It implements secure token handling and IETF authentication patterns. Claude Code Gemini CLI CX Codex 743installs google-cloud-scc-remediation official google This skill handles Google Cloud Security Command Center findings, from IAM fixes to resource misconfigurations. Use it when an agent must address a specific finding. Claude Code Gemini CLI CX Codex 742installs salesforce-apex-quality official github Checks Apex for governor-limit risks, security gaps, and missing tests. Use it when GitHub Copilot reviews or generates Salesforce classes, triggers, and test code. GitHub Copilot 884installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs

Questions about wordpress-penetration-testing

How do I install wordpress-penetration-testing in Claude Code?

Run npx skills add sickn33/agentic-awesome-skills --skill wordpress-penetration-testing -a claude-code, then open ~/.claude/skills/wordpress-penetration-testing/SKILL.md.

What does wordpress-penetration-testing do?

It scans WordPress sites for common vulnerabilities, checks plugin REST API permissions, and identifies security misconfigurations. It requires written owner authorization before any testing.

What tools does this skill need?

WPScan, Metasploit Framework, Burp Suite or OWASP ZAP, Nmap, and cURL or wget. WPScan comes pre-installed in Kali Linux.

Source text

SKILL.md · MIT 
---
name: wordpress-penetration-testing
description: "Assess WordPress installations for common vulnerabilities and installed core/plugin REST permission boundaries."
risk: offensive
source: community
author: zebbern
date_added: "2026-02-27"
---

> **⚠️ AUTHORIZED USE ONLY**
> This skill is for educational purposes or authorized security assessments only.
> You must have explicit, written permission from the system owner before using this tool.
> Misuse of this tool is illegal and strictly prohibited.

> **Mandatory confirmation gate**
> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
> 1. Ask the user to state the exact target URL, IP, account, or resource.
> 2. Ask the user to confirm written authorization and the permitted scope.
> 3. Show the exact command(s) and explain their expected effect.
> 4. Wait for explicit confirmation in the current conversation.
>
> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.

# WordPress Penetration Testing

## Detailed Guide

Read [the detailed guide](references/detailed-guide.md) before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.

## Prerequisites

### Required Tools
- WPScan (pre-installed in Kali Linux)
- Metasploit Framework
- Burp Suite or OWASP ZAP
- Nmap for initial discovery
- cURL or wget

### Required Knowledge
- WordPress architecture and structure
- Web application testing fundamentals
- HTTP protocol understanding
- Common web vulnerabilities (OWASP Top 10)

## Constraints and Limitations

### Legal Considerations
- Obtain written authorization before testing
- Stay within defined scope
- Document all testing activities
- Follow responsible disclosure

### Technical Limitations
- WAF may block scanning
- Rate limiting may prevent brute-force
- Some plugins may have false negatives
- XML-RPC may be disabled

### Assessment Traffic Controls
- Agree source IPs, request rates, maintenance window, stop conditions and any proxy with the owner.
- Throttle requests: `--throttle 1000` is an example to verify against installed WPScan help.
- A blocked scan is a finding or scope limit; do not rotate proxies or switch authentication channels to evade agreed controls.

## When to Use
This skill is applicable to execute the workflow or actions described in the overview.

© zebbern · MIT · sickn33/agentic-awesome-skills

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor