wp-plugin-rest-auth-bypass

To find unauthenticated write access in WordPress plugin REST API endpoints, enumerate third-party plugin namespaces, map their routes, and test state-changing HTTP methods like POST, PUT, PATCH, and DELETE for unauthenticated access.

Standard WordPress security scanning misses unauthenticated plugin REST endpoints because generic vulnerability scanners often fail to enumerate custom plugin namespaces and map unauthenticated state-changing operations outside of core routes.

Enumerate WordPress plugin REST namespaces for penetration testing by querying the target site's REST API, filtering out core namespaces, and isolating custom plugin routes to map all available endpoints.

Yes, you can test unauthorized content publishing and settings modification by validating identified unauthenticated state-changing endpoints for common exploit vectors without valid credentials.

The best way to validate exploitable write access in WordPress REST API routes is to send unauthenticated requests to mapped POST, PUT, PATCH, and DELETE endpoints to confirm unauthorized content publishing, settings modification, or data leakage.

Yes, this method works for discovering hidden endpoints in third-party WordPress plugins by filtering out core namespaces and mapping all custom plugin routes to identify unauthenticated access to state-changing operations.