cors-credential-wordpress
Fail
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: HIGHDATA_EXFILTRATIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill provides explicit instructions and a JavaScript Proof-of-Concept (PoC) for exfiltrating sensitive data from a target's WordPress REST API to attacker-controlled domains (e.g.,
https://evil.comandhttps://YOUR_COLLABORATOR/log). Evidence includes scripts that encode extracted data into Base64 before sending it to a remote server. - [COMMAND_EXECUTION]: The skill utilizes shell commands (
curl) specifically configured to spoofOriginheaders. These commands are intended to probe and bypass security controls on remote systems to retrieve non-public data like user IDs, emails, and slugs. - [CREDENTIALS_UNSAFE]: The skill documents an attack vector for "Cookie Theft" using CORS credential reflection. It explains how to capture a victim's WordPress session cookie by using the
credentials: "include"flag in cross-origin requests, facilitating unauthorized administrative access and account takeover.
Recommendations
- AI detected serious security threats
Audit Metadata