WordPress Hacking

Some useful resources for hacking WordPress and it's plugins and themes.

Bug Bounty

If you're passionate about finding and reporting WordPress vulnerabilities, consider joining these bug bounty programs: Wordfence and Patchstack. Signing up through my Wordfence link gives me a small bonus when you report 5 vulns, helping support my work on tools and resources for the community. Thank you!

Plugin

I have written a plugin designed to help dynamic analysis and hacking of WordPress plugins and themes, this can be found in the plugin branch in this repo.

Reports

The reports directory contains a selection of my publicly disclosed vulnerability reports that were disclosed to bug bounty programs. I've tried to get a good cross-section of different vulnerability types.

These 📄 reports are in their original formats when originally submitted. Any mistakes are mine, for prettier versions please see the ones that have linked blog posts 🔗. Where I created a Python proof-of-concept script you will find it in the folder or directly by clicking on 🐍.

Python Functions

Feel free to reuse my Python code to help write you own PoCs, in future I may turn some of the functions into an easy-to-use library.

Support

If you love what I'm doing with wordpress-hacking or my other projects, please feel free to contribute without spending money by creating issues, PRs, or just messaging me to let you know you use it. And of course, you can directly sponsor this project on GitHub or buy me a coffee ☕! Thank you for your support – it means the world to me and the open source community!