WordPress Penetration Testing
Warn
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to utilize a variety of offensive security tools including Nmap, WPScan, and the Metasploit Framework. These instructions guide the agent to perform active discovery, user enumeration, and automated password brute-force attacks against target WordPress installations.
- [DYNAMIC_EXECUTION]: The skill includes functional templates for generating malicious files at runtime. Specifically, it provides code for a PHP-based web shell capable of executing system commands via HTTP parameters, and a Bash-based reverse shell payload designed for injection into WordPress theme files to establish remote connections.
- [REMOTE_CODE_EXECUTION]: The provided methodology details how to achieve code execution on remote servers. This includes the use of automated exploitation modules (e.g.,
wp_admin_shell_upload) and manual exploitation workflows that leverage administrative access to modify theme and plugin files to execute arbitrary code.
Audit Metadata