CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

exploit poc rce php-security wordpress-security detection-rules vulnerability-research suricata-rules waf-rules php-exploit session-upload-progress cve-2026-109618 cve-2026-109619 php2shell

• Updated Oct 28, 2026
• Python

Recon & pentest skill pack. CORS, XSS, SQLi, SSRF, RCE, WordPress, MCP, cloud, subdomain takeover, and more. Field-tested. MIT. Full write-up at hiago.sh

penetration-testing bug-bounty wordpress-security offensive-security red-team ssrf security-automation reconnaissance cloud-security subdomain-enumeration supabase firebase-hacking jwt-attacks hermes-agent cors-exploitation

• Updated Nov 7, 2026
• Python

Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.

security static-code-analysis penetration-testing dynamic-analysis application-security wordpress-security mobile-security vulnerability-management vulnerability-scanners security-scanner vulnerability-assessment network-security webappsec vulnerability-scanning source-code-analysis penetration-testing-framework security-vulnerability-assessment

• Updated Mar 18, 2024
• Java

WPScan rewritten in Python + some WPSeku ideas

python wordpress wordpress-plugin wordpress-theme vulnerabilities wordpress-security wordpress-scanner wpscan hacktoberfest vulnerability-scanners

• Updated Jun 4, 2021
• Python

WAF for WordPress 🔥 with 60+ security checks and weekly updates

plugin wordpress security firewall waf wordpress-security fail2ban

• Updated Apr 16, 2026
• PHP

The vulnerable version of WordPress that is updated monthly.

wordpress cybersecurity wordpress-security

• Updated Jan 14, 2025

Open-source, lab-driven study notes for building, administering, hardening, and operating WordPress at scale — 28 modules across install, content, security, performance, and DevOps (CC BY 4.0).

wordpress wp-cli devops sysadmin self-hosted woocommerce wordpress-security security-hardening performance-optimization headless-wordpress wordpress-hardening wordpress-administration

• Updated Jul 24, 2026

GoBuildWP (formerly WPPilot): WordPress MCP server & AI agent for ChatGPT, Claude, Cursor, Codex. Build and edit full websites in Elementor and Gutenberg, run SEO, PageSpeed checks, safe updates, backups and security, many sites via GoBuildWP Cloud. Safety profiles, human approval, undo. Free core; Pro adds WooCommerce and more builders.

wordpress-plugin cursor gutenberg wordpress-security pagespeed wordpress-updates claude wordpress-seo ai-agent chatgpt wordpress-ai ai-website-builder website-speed model-context-protocol mcp-server wordpress-ai-agent wordpress-mcp-server elementor-mcp wordpress-mcp woocommerce-mcp

• Updated Nov 9, 2026
• PHP

AI coding agent skills for shipping, maintaining secure WordPress Sites

php wordpress security wordpress-security ai-agents coding-agents agent-skills claude-code

• Updated Sep 29, 2026
• PHP

Advanced web security scanner with 49 modules, evasion engine, and CVE database.

python open-source penetration-testing sql-injection web-security wordpress-security xss-detection vulnerability-scanners security-scanner security-tools waf-bypass cve-scanner

• Updated Oct 16, 2026
• Python

AI SKILL.md files

wordpress wordpress-plugin security performance wordpress-development skills wordpress-theme seo-optimization wordpress-security ai-agents wordpress-performance plugin-development content-creation llm-agent

• Updated Oct 4, 2026
• PHP

A command line took to check the WPScan Vulnerability Database via API to identify the security issues of WordPress plugins installed.

wordpress wordpress-plugin security continuous-integration wordpress-security hacktoberfest wordpress-security-scanner vulnerability-checker

• Updated Oct 22, 2023
• PHP

Concluded research prototype — do not install. Final finding: github.com/dknauss/Sudo/blob/main/docs/finding.md

sudo wordpress-security access-control zero-trust wordpress-auth research-archive wordpress-users principle-of-least-privilege

• Updated Oct 19, 2026
• PHP

WPAUDIT: Advanced WordPress security auditing suite & vulnerability scanner. Automates pentesting with Nmap, WPScan, Nuclei, SQLMap. Comprehensive reports. Ideal for ethical hackers & Kali Linux.

python wordpress security-audit cybersecurity nmap penetration-testing nuclei wordpress-security information-security kali-linux wpscan sqlmap hacktoberfest ethical-hacking security-automation security-tools vulnerbility-research wordpress-vulnerability vulnerbility-analysis penetration-tool

• Updated May 27, 2025
• Python

Useful plugin that will scan your theme templates for malicious injections. Automatically. Every day. For more blog security.

wordpress wordpress-plugin antivirus wordpress-security hacktoberfest

• Updated Oct 31, 2026
• PHP

A wordpress security auditor! Audit your wordpress application for security issues with even 1 request.

wordpress security auditing shodan tool enumeration pentesting hardening vulnerabilities wordpress-security password-checker username-checker wpscan-vulnerability-database wordpress-security-scanner

• Updated Jan 13, 2026
• Python

The battle-tested, all-in-one .htaccess configuration for WordPress. Combines H5BP performance standards, Perishable Press 8G Firewall WAF, and empirical zero-PHP threat intelligence.

wordpress caching security performance web-performance apache waf brotli reverse-proxy cybersecurity htaccess wordpress-security h5bp wordpress-website wp-htaccess security-headers 8g-firewall

• Updated Nov 10, 2026
• Python

Audit, clean, and harden a WordPress site end to end, with an AI agent (Claude/Cursor/Codex/MCP or SSH). Detects & removes hidden malware — cloaking, backdoors, database injection — scores your security posture, and hardens safely. Free, open-source (AGPL-3.0).

php wordpress wp-cli wordpress-plugin security-audit mcp incident-response wordpress-security cloaking security-tools claude malware-detection malware-scanner malware-removal wordpress-hardening website-security ai-agent claude-code japanese-keyword-hack seo-spam

• Updated Oct 10, 2026
• Python

Apache configuration and useful functions for more secure and performant Wordpress sites.

php wordpress security wordpress-development apache wp htaccess wordpress-security

• Updated Mar 11, 2025
• PHP

wordpress security best practice

wordpress wordpress-development wordpress-security wordpress-site wordpress-setup wordpress-settings wordpress-guide wordpress-hardening wordpress-best-practice hardening-wordpress securing-wordpress

• Updated Jun 5, 2024