cors-credential-wordpress

Fail

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: HIGHDATA_EXFILTRATIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [DATA_EXFILTRATION]: The skill provides explicit instructions and a JavaScript Proof-of-Concept (PoC) for exfiltrating sensitive data from a target's WordPress REST API to attacker-controlled domains (e.g., https://evil.com and https://YOUR_COLLABORATOR/log). Evidence includes scripts that encode extracted data into Base64 before sending it to a remote server.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands (curl) specifically configured to spoof Origin headers. These commands are intended to probe and bypass security controls on remote systems to retrieve non-public data like user IDs, emails, and slugs.
  • [CREDENTIALS_UNSAFE]: The skill documents an attack vector for "Cookie Theft" using CORS credential reflection. It explains how to capture a victim's WordPress session cookie by using the credentials: "include" flag in cross-origin requests, facilitating unauthorized administrative access and account takeover.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 31, 2026, 04:46 PM
Security Audit — agent-trust-hub — cors-credential-wordpress