wordpress-penetration-testing

High-risk offensive security skill. Its capabilities are internally consistent with WordPress penetration testing, and the WPScan token flow appears to use the official service, but the skill materially enables scanning, brute-force attacks, exploitation, webshell/reverse-shell deployment, and TLS-check disabling. This is not confirmed malware, but it is a dangerous pentesting skill that should be treated as vulnerable/high risk.

This fragment is an explicit, end-to-end WordPress intrusion/exploitation playbook. It includes weaponized payloads (PHP webshell executing $_GET['cmd'], reverse-shell instructions to attacker-controlled LHOST) and actionable chaining of enumeration, brute-force login, and post-auth shell installation (theme editor/plugin upload and Metasploit guidance). In a supply-chain security context, it is best treated as malicious content with maximal security risk rather than legitimate code. No benign dependency functionality is evidenced.