WordPress Plugin REST API — Auth Bypass

WordPress plugins register custom REST API routes at /wp-json/{namespace}/. Many plugin developers forget to add permission callbacks, leaving state-changing endpoints (POST/PUT/PATCH/DELETE) accessible to unauthenticated users. This skill enumerates all plugin routes, identifies write endpoints missing auth, and exploits them for content publishing, settings modification, and data leakage.

When to Use

• Target is a WordPress site with exposed users via /wp-json/wp/v2/users.
• You've found interesting plugin namespaces from /wp-json/ but need to map their routes.
• Standard WordPress endpoints return 401 — but third-party plugin endpoints might not.
• You want to find hidden admin URLs, debug endpoints, or unauthenticated write operations.

Prerequisites

• python3 with requests library.
• Target WordPress site URL.

Procedure

Phase 1 — Enumerate All Plugin Namespaces