cors-credential-wordpress

1# CORS Credential WordPress Skill
2 
3Detect, confirm, and exploit CORS credential reflection on WordPress REST API endpoints. CORS misconfiguration is one of the most common critical findings in US SMB WordPress sites (~7-8% of all WP targets), enabling cross-origin data exfiltration with victim cookies. Documents 8 CORS variants and full browser PoC construction.
4 
5## When to Use
6 
7- After `wp-mass-recon` flags a target with `Access-Control-Allow-Credentials: true`.
8- Testing any WordPress site's REST API for cross-origin data access.
9- Building attack chains: CORS → user enumeration → spear-phishing → ATO.
10- Validating whether a CORS finding is exploitable (not just present).
11 
12## Prerequisites
13 
14- curl and python3.
15- `web_extract` or `browser_navigate` for browser PoC verification.
16- Target must have WordPress REST API accessible (`/wp-json/wp/v2/`).
17 
18## How to Run
19 
20```bash
21# Quick detection
22curl --max-time 30 --connect-timeout 10 -skI "https://TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com" | grep -iE "access-control"
23 
24# Full CORS matrix (10 endpoints)
25for ep in "users" "posts" "pages" "media" "comments" "categories" "tags" "settings" "plugins" "themes"; do
26  echo "=== /wp-json/wp/v2/$ep ==="
27  curl --max-time 30 --connect-timeout 10 -skI "https://TARGET/wp-json/wp/v2/$ep" -H "Origin: https://evil.com" | grep -iE "access-control|http/"
28  echo ""
29done
30```
31 
32## Quick Reference
33 
34| Variant | Detection | Exploitability |
35|---------|-----------|----------------|
36…