Dynamic probe
Broken access control, proven — not pattern-matched
The most exploited WordPress vulnerability class is REST endpoints missing authorization. Static scanners guess at permission_callbacks. We just try the endpoint — as an attacker would.
How it works
Your plugin boots in a sandbox
WP Playground installs and activates your plugin in a real WordPress environment — the same one our activation matrix uses. No mocked functions, no stubs.
We attack every route
As an unauthenticated user, we fire a write request at every non-core REST route your plugin registers. Param routes get substituted IDs — /items/(?P<id>\d+) becomes /items/1.
Proof lands in your report
Any route that answers 2xx unauthenticated is flagged HIGH with the exact route, method, and status code. Not 'your permission_callback looks weak' — 'this endpoint accepted a write with no login'.
Built for truth, not noise
- Every non-core route is probed — not a sample
- Param routes are covered via ID substitution, not skipped
- Runs through the real REST permission stack (rest_do_request), so permission_callback logic is exercised for real
- Write methods only (POST/PUT/PATCH/DELETE) — no false alarms on read-only public data
- Capped at 50 routes per run so audits stay fast
- Included with the Playground engine (optional, +1 token) on every audit tier