wordpress-plugin-hunt

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive reconnaissance and exploitation guide for WordPress sites, including automated scanning, instructions for unauthenticated RCE via file uploads, auth bypasses, privilege escalation, and commands to retrieve sensitive data — clearly intended for malicious compromise.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The WordPress Plugin Hunt Skill ingests outsider-authored free text at runtime by fetching and processing target-controlled webpage HTML, plugin readme.txt files, and REST API responses from attacker-chosen endpoints (e.g., /wp-json/$ns, /wp-content/plugins/$slug/readme.txt, and /), and then greps/parses the returned content.