wp-plugin-rest-auth-bypass

name	wp-plugin-rest-auth-bypass
description	Scan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth, enumerate all plugin routes, and test for unauthorized content publishing, settings modification, and data leakage.
version	1.0.0
author	uphiago
license	MIT
platforms	["linux","macos","any"]
compatibility	Requires python3, curl
metadata	{"hermes":{"tags":["recon","wordpress","rest-api","auth-bypass","plugin-exploit","unauthorized-access","content-publishing"],"category":"recon","related_skills":["firebase-supabase-attack","js-secrets-extraction","hunt-api-misconfig","source-leak-hunt"]}}

WordPress Plugin REST API — Auth Bypass

WordPress plugins register custom REST API routes at /wp-json/{namespace}/. Many plugin developers forget to add permission callbacks, leaving state-changing endpoints (POST/PUT/PATCH/DELETE) accessible to unauthenticated users. This skill enumerates all plugin routes, identifies write endpoints missing auth, and exploits them for content publishing, settings modification, and data leakage.

When to Use

• Target is a WordPress site with exposed users via /wp-json/wp/v2/users.
• You've found interesting plugin namespaces from /wp-json/ but need to map their routes.
• Standard WordPress endpoints return 401 — but third-party plugin endpoints might not.
• You want to find hidden admin URLs, debug endpoints, or unauthenticated write operations.

Prerequisites

• python3 with requests library.
• Target WordPress site URL.

Procedure

Phase 1 — Enumerate All Plugin Namespaces

curl -sk "https://target.com/wp-json/" | python3 -c "
import sys, json
data = json.load(sys.stdin)
for ns in data.get('namespaces', []):
    print(ns)
"

Filter out standard WordPress namespaces to find third-party plugins:

Standard: oembed/1.0, wp/v2, wp-site-health/v1, wp-block-editor/v1
Plugins:  gpl/v1, sliderrevolution, yoast/v1, elementor/v1, wc/v3, gf/v2, ...

Phase 2 — Map All Routes for Each Plugin

import requests, json

BASE = "https://target.com"

# Get full route map
r = requests.get(f"{BASE}/wp-json/", timeout=10)
data = r.json()

for plugin_ns in ["gpl/v1", "gsf/v1", "sliderrevolution", "solidwp-mail/v1"]:
    r = requests.get(f"{BASE}/wp-json/{plugin_ns}/", timeout=10)
    if r.status_code == 200:
        routes = r.json().get(, {})
         path, config  routes.items():
            methods = config.get(, [])
            args = (config.get(, [{}])[].get(, {}).keys())
            ()
             args:
                ()