wpscan

SUSPICIOUS. The skill is aligned with WPScan’s security-scanning purpose and has no evident credential exfiltration or untrusted installer. However, it provides actionable brute-force and aggressive enumeration workflows, including rate-limit bypass guidance, without requiring authorization, and includes an example that disables TLS verification. Use only against explicitly authorized targets and keep TLS checks enabled.

The fragment is an offensive WordPress security-testing guide. It documents credential brute forcing, SSRF-based port probing, sensitive-file discovery, vulnerability exploitation, and post-authentication remote command execution. It is not itself malware or an installable package payload, and no obfuscated malicious code or embedded credentials are present. Use only with explicit authorization; the documented commands can compromise WordPress sites and expose credentials or internal services.