WordPress Security Scanner — REST API User & Draft Leaks

Probes a WordPress site's REST API the way an unauthenticated attacker would, surfacing the endpoints that leak data by default: user enumeration, draft posts, the installed-plugin list, site settings, and misconfigured WooCommerce customer/order routes. For WordPress site owners, agencies and pentesters checking their own installs. Pricing: $0.02 per run + $0.005 per finding. Non-destructive — read-only, unauthenticated GETs, nothing written or altered.

Why default WordPress leaks

WordPress powers ~43% of the web, and its REST API is on and mostly public by default. Without hardening, anyone can query, no auth required:

Endpoint	What it hands an attacker
/wp-json/wp/v2/users	Every user's login slug + display name → a username list for brute force
/wp-json/wp/v2/posts?status=draft	Unpublished draft content
/wp-json/wp/v2/plugins	Installed plugins + versions → a ready-made CVE checklist
/wp-json/wp/v2/settings	Admin email, blog name, other site settings
/wp-json/wc/v3/customers, /orders	WooCommerce customer emails/addresses if API keys are misconfigured

Security plugins (Wordfence, iThemes) catch some of these and miss others. This scanner checks the core, WooCommerce and common-plugin endpoints in one pass and shows you exactly what's exposed.

Run it in two ways

{
  "wordpressUrl": "https://your-site.com",
  "endpointHints": ["custom/v1/private-route"],
  "outputFormat": "both"
}

• Provide wordpressUrl to scan your live site.
• Leave inputs empty and click Run for a DEMO sample report — see the output shape with no target.
• endpointHints adds custom routes to probe; outputFormat is json, html-report, or both.

What you get back

• Dataset rows — one structured finding each, severity-coded, with a curl reproducer.
• HTML report in the run's KV store — severity-coded findings plus paste-ready fix code.

[CRITICAL] /wp/v2/users — user enumeration
Total records: 12
Reproducer: curl 'https://your-site.com/wp-json/wp/v2/users'

The fix ships with the finding

Every run includes a drop-in must-use plugin. Put it at wp-content/mu-plugins/disable-anon-rest.php and re-scan:

<?php
add_filter('rest_endpoints', function ($endpoints) {
  if (!current_user_can('list_users')) {
    unset($endpoints['/wp/v2/users']);
    unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']);
  }
  return $endpoints;
});
add_filter('rest_pre_dispatch', function ($result, $server, $request) {
  $route = $request->get_route();
  foreach (['/wp/v2/plugins', '/wp/v2/themes', '/wp/v2/settings'] as $denied) {
    if (str_starts_with($route, $denied) && !current_user_can('manage_options')) {
      return new WP_Error('rest_forbidden', 'Forbidden.', ['status' => 401]);
    }
  }
  return $result;
}, 10, 3);

Prefer a plugin? "Disable WP REST API" blocks all anonymous access; Wordfence Premium has REST hardening rules.

Ethical use

Scan only sites you own or have explicit permission to test. All probes are read-only, unauthenticated GETs — identical to what any anonymous visitor's browser could request — so the scan itself changes nothing.

FAQ

Is scanning my own WordPress site safe? Yes. It performs only unauthenticated GET requests against public REST endpoints — no writes, no login attempts, no exploitation. It reads exactly what an anonymous visitor already can.

How is this different from Wordfence or a WPScan run? Those are broad malware/vulnerability suites. This is focused specifically on REST-API data exposure (user enumeration, drafts, plugin disclosure, WooCommerce leaks) and returns a copy-paste mu-plugin fix per finding — a fast, targeted check you can run on a schedule.

What's a billable finding? Each exposed endpoint detected is one $0.005 dataset item; the run is $0.02. A properly hardened site returns few or no findings.

Does it exploit the vulnerabilities or read private data? No — it confirms an endpoint responds to an anonymous request and records the count/shape. It does not dump customer records or attempt any write.

Can I scan a WooCommerce store's customer data exposure? Yes — the WooCommerce /wc/v3/customers and /orders routes are probed; a finding there means API-key misconfiguration is leaking customer data and should be fixed immediately.

Can I try it before pointing it at my site? Yes — run with empty inputs for a demo report.

I found leaks — can someone just fix it for me? A $29 quick scan + report and a $99 full hardening (custom mu-plugin written, installed and verified, money-back) are available, plus weekly auto-scans at rls-monitor.vercel.app.

Sister scanners

For other backends: Supabase, Firebase, Strapi, Directus, Payload, Convex, Hasura, PocketBase, Nhost.