T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:23- Finding
TLS Certificate Verification Disabled for Authenticated WordPress Requests
- Content
View full analysis
HTML content here", "status": "publish", "categories": [CAT_ID], "slug": "post-slug" }' | python3 -c "import sys,json;d=json.load(sys.stdin);print(f'Published: {d[\"link\"]}')" ``` ```bash curl -sk -u "USER:PASS" "$WP_API_BASE/posts?per_page=5&search=keyword" ``` ```bash curl -sk -u "USER:PASS" \ -X PUT "$WP_API_BASE/posts/POST_ID" \ -H 'Content-Type: application/json' \ -d '{"title":"New Title","content":"Updated
"}' ``` ```bash curl -sk -u "USER:PASS" -X DELETE "$WP_API_BASE/posts/POST_ID?force=true" ``` ### Technical Analysis The `-k` option instructs curl to skip server-certificate verification. These requests also use HTTP Basic Authentication through `-u`, which places the WordPress username and application password in the HTTP Authorization header. Although HTTPS encryption is requested through the configured API URL, disabling certificate verification prevents the client from establishing that it is communicating with the legitimate WordPress server. An attacker able to intercept or redirect network traffic can present an arbitrary certificate, impersonate the server, and receive the authenticated request. The pre-scan concern about remote script execution is not confirmed. The pipeline on lines 23-27 sends API JSON into a local Python JSON parser; it does not pipe a d ...[truncated 1301 chars]- Remediation
View remediation