Advanced WordPress REST API endpoint vulnerability scanner designed to identify exposed endpoints and potential security risks in WordPress installations.
WordPress-Fix is a security assessment tool that systematically scans WordPress websites for exposed REST API endpoints. It helps security professionals and system administrators identify potential vulnerabilities, misconfigurations, and sensitive data exposures in WordPress installations.
The tool performs comprehensive endpoint scanning, filters out false positives, and provides clear security recommendations based on findings.
- Comprehensive WordPress REST API endpoint scanning
- Intelligent exception filtering to eliminate false positives
- Multi-threaded scanning for improved performance
- Sensitive data detection (emails, passwords, API keys, tokens)
- Automatic gzip decompression support
- Human-readable response size formatting
- Only displays genuine 200 OK responses with actual data
- JSON response parsing and validation
- Security recommendations based on scan results
- Verbose mode for detailed debugging
- Customizable payload files
- Thread control for performance tuning
# Debian/Ubuntu
sudo apt-get install curl jq grep sed awk
# RHEL/CentOS
sudo yum install curl jq grep sed awk
# macOS
brew install curl jq grep sed awkgit clone https://github.com/yourusername/wordpress-fix.git
cd wordpress-fix
chmod +x wordpress-fix.shwordpress-fix.sh- Main scanner scriptpayloads.txt- Endpoint list file (included or custom)
./wordpress-fix.sh -u https://example.com# With custom timeout and output file
./wordpress-fix.sh -u https://example.com -t 15 -o custom_results.txt
# With more threads for faster scanning
./wordpress-fix.sh -u https://example.com -T 20
# Verbose mode to see all status codes
./wordpress-fix.sh -u https://example.com -v
# Custom payloads file
./wordpress-fix.sh -u https://example.com -f custom_payloads.txt
# All options combined
./wordpress-fix.sh -u https://example.com -t 10 -T 15 -v -o results.txt| Option | Description | Default |
|---|---|---|
-u, --url |
Target WordPress site URL | Required |
-t, --timeout |
Connection timeout in seconds | 10 |
-o, --output |
Custom output file name | Auto-generated |
-f, --file |
Custom payloads file | payloads.txt |
-T, --threads |
Number of parallel threads | 5 |
-v, --verbose |
Verbose output mode | Disabled |
-h, --help |
Display help information | - |
[+] FOUND: /wp-json/wp/v2/users
Status: 200 | Type: application/json | Size: 2KB
Items: 10
[!] WARNING: Sensitive data detected!
---
[+] FOUND: /wp-json/wp/v2/posts
Status: 200 | Type: application/json | Size: 15KB
Items: 50
---
Results are saved in CSV-like format:
# WordPress-Fix Scan Results
# Target: https://example.com
# Date: Mon Jan 1 12:00:00 UTC 2024
# ==================================
https://example.com/wp-json/wp/v2/users|200|application/json|2048|10|SENSITIVE
https://example.com/wp-json/wp/v2/posts|200|application/json|15360|50
Based on scan results, WordPress-Fix provides actionable security recommendations:
- Restrict access to exposed REST API endpoints
- Implement proper authentication mechanisms
- Disable REST API for unauthorized users
- Configure .htaccess or nginx rules for access control
- Enable WordPress security plugins
- Update WordPress core, themes, and plugins
- Monitor API request logs for suspicious activity
- Implement Web Application Firewall (WAF)
- Enforce strong authentication and session management
- Regular security audits and penetration testing
The payloads.txt file contains endpoints to scan. Format:
# Comments start with #
/wp-json
/wp-json/wp/v2/users
/wp-json/wp/v2/posts?per_page=100
The default payloads file includes:
- WordPress Core REST API endpoints
- Plugin-specific endpoints (Wordfence, Yoast, WooCommerce, Elementor)
- Admin and system endpoints
- Configuration and database exposure checks
- File access and directory listing endpoints
- Backup and security plugin endpoints
- User enumeration endpoints
- GraphQL endpoints
Regular security scanning to identify newly exposed endpoints after updates or plugin installations.
./wordpress-fix.sh -u https://example.com -o weekly_audit_$(date +%Y%m%d).txtScan staging environments before deploying to production.
./wordpress-fix.sh -u https://staging.example.com -vIdentify potential data leaks and misconfigurations.
./wordpress-fix.sh -u https://example.com -T 20 -v- Reads endpoints from payloads file
- Makes HTTP requests to each endpoint
- Filters responses for genuine 200 OK results
- Parses and validates JSON responses
- Detects sensitive data patterns
- Displays formatted summary
- Saves detailed results to file
The tool intelligently filters out false positives including:
- WordPress REST API error responses
- Authentication required pages
- Permission denied responses
- HTML error pages (403, 404, 500)
- Empty or null data responses
- Login page redirects
Scans for patterns including:
- Email addresses
- Password fields
- API keys and tokens
- User credentials
- Database connection strings
- Configuration files
- Backup files
- Session tokens
Size: Unknown
Occurs when Content-Length header is missing. The tool uses actual file size from downloaded response.
No results found
Target may not be WordPress or endpoints are properly secured. Try verbose mode to see status codes.
Permission denied
Ensure script has execute permissions: chmod +x wordpress-fix.sh
Dependency missing
Install required packages as shown in installation section.
Enable verbose mode to see all HTTP status codes and filtered endpoints:
./wordpress-fix.sh -u https://example.com -v- Always obtain proper authorization before scanning
- Use on systems you own or have permission to test
- Run scans during maintenance windows to minimize impact
- Keep results confidential
- Act on findings promptly
- Implement defense-in-depth security measures
- Regular scanning as part of security maintenance
This tool is provided for authorized security testing and educational purposes. Users are responsible for ensuring they have proper authorization before scanning any systems.
This tool is for security research and testing purposes only. The authors are not responsible for misuse or damage caused by this software. Always ensure you have written permission before scanning any systems.
LinkTree: https://linktr.ee/abhinavsingwal