wordpress.org

Results Summary

29 findings detected across wordpress.org.

8 components identified. WordPress detected: Yes.

Severity Breakdown

Total findings detected across all components. The public summary below groups findings by vulnerability type. To see every affected component in full detail, run a free scan on your own domain at vulnify.app/tools.

Findings Overview

29 unique issues shown below, grouped from 29 total findings. When a vulnerability affects multiple components, it is listed once with the affected component count.

• high Content-Security-Policy (CSP): missing

  Prevents XSS and data injection attacks

• high Content-Security-Policy header missing

  No CSP header detected. XSS impact surface is larger.

• medium Comprehensive mode confirmed more version-level WordPress evidence than the homepage alone

  Homepage version-confirmed components: 3; comprehensive version-confirmed components: 7.

• medium xmlrpc.php responded on the public WordPress surface

  Observed xmlrpc.php status 429. Restrict or disable xmlrpc unless a business-critical workflow still requires it.

• medium REST API user-related routes appear discoverable from wp-json output

  The wp-json response referenced user endpoints. Review whether public user enumeration should be constrained on this site.

• medium WordPress installation or upgrade surfaces responded publicly

  HEAD /wp-admin/install.php -> 429; HEAD /wp-admin/upgrade.php -> 429.

• medium Public plugin readme files confirmed additional version evidence

  gutenberg v24.2.0, jetpack v16.3, code-syntax-block v3.2.1

• medium The public users endpoint returned account records

  GET /wp-json/wp/v2/users?per_page=1 returned status 200. Public account records: 8. Names are not copied into this report.

• medium One or more detected plugins are behind the WordPress.org release

  jetpack 16.3 -> 16.3.1

• medium X-Content-Type-Options: missing

  Prevents MIME-type sniffing

• medium X-XSS-Protection: missing

  Legacy XSS protection (modern browsers use CSP)

• medium Referrer-Policy: missing

  Controls how much referrer information is shared

• medium Permissions-Policy: missing

  Controls browser features and APIs

• medium [REDACTED]: missing

  Restricts Adobe Flash and PDF policies

• medium HTTP resources detected on page

  Found 1 HTTP resource reference(s). Active=0, passive=0.

• medium Potentially sensitive paths are accessible

  /admin (200, admin-surface, confidence:medium), /wp-admin (200, admin-surface, confidence:medium), /wp-login.php (200, reachable-artifact, confidence:medium)

• medium Administrative entry surfaces responded publicly

  /admin (200), /wp-admin (200)

• low WordPress component footprint detected

  Detected 8 core/theme/plugin component signal(s) from public asset paths.

• low wp-cron.php responded on the public surface

  Observed wp-cron.php status 429. This endpoint is often abused for nuisance traffic or workload amplification if left unconstrained.

• info WordPress footprint signals detected

  WordPress signal count: 5. Confirm the target is a live WordPress frontend URL.

What the WordPress Stack Check Covers

This security profile for wordpress.org was generated by Vulnify. The check analyzes:

• WordPress core version detection and known vulnerability lookup
• Active theme identification and security assessment
• Plugin inventory with version and CVE checks
• Security headers and hardening controls
• Exposed wp-config and sensitive file checks
• XML-RPC and REST API exposure assessment

Prioritized Actions

• highUpdate the listed plugins
• highAdd Content-Security-Policy (CSP) header
• highAdd baseline CSP
• highHarden cookies
• highMigrate asset links to HTTPS
• highRestrict sensitive paths
• highAdd edge-layer deny rules
• mediumRestrict or disable xmlrpc.php
• mediumReview REST API user exposure
• mediumConstrain public maintenance surfaces
• mediumStop anonymous access to the users endpoint
• mediumAdd X-Content-Type-Options header
• mediumAdd Referrer-Policy header
• mediumAdd Permissions-Policy header
• mediumUse hardened cookie prefixes where possible

About This Check

This report was generated using Vulnify's free security tools. Results reflect the configuration at the time of the check. For ongoing monitoring, detailed remediation guidance, and vulnerability scanning across 50+ security tests, create a free Vulnify account.

Last checked: October 18, 2026