Performs systematic security audits and vulnerability analysis for WordPress themes, plugins, and custom code.
This skill provides a specialized workflow for identifying security vulnerabilities within the WordPress ecosystem by scanning for critical risks such as SQL injection, Cross-Site Scripting (XSS), and Broken Access Control. It maps findings to the OWASP Top 10 WordPress manifestations, analyzing input validation, nonce verification, and capability checks to help developers secure their code before release or investigate suspected breaches. With detailed reporting including line numbers and severity levels, it ensures that WordPress-specific security anti-patterns are identified and mitigated efficiently.
Key Features
013 GitHub stars
02OWASP Top 10 mapping tailored specifically for WordPress environments
03Critical vulnerability scanning for SQLi, XSS, CSRF, and RCE
04Detailed authorization and capability check verification using current_user_can()
05Context-aware analysis of file operations, database queries, and external requests
06Automated detection of missing nonces and insecure AJAX/REST handlers
Use Cases
01Auditing custom WordPress plugins or themes before a public release or security certification
02Investigating a suspected site breach to identify malware, backdoors, or entry points
03Performing security-focused code reviews on Pull Requests to ensure best practices are followed
