other
Error
- Location
SKILL.md:22- Finding
External Collection of Reusable WordPress Administrative Credentials
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:22-30,SKILL.md:50-57,SKILL.md:76-88,SKILL.md:98-109,SKILL.md:149-150;openapi.json:116-160
Vulnerability Type: External collection of privileged credentials
Risk Level: HighVulnerable Code Snippets
SKILL.md:22-30:markdown Perform comprehensive optimization on a WordPress site using administrative credentials: **Sample Request:** ```json { "site": "https://example.com", "username": "admin", "password": "secure_password_here" }SKILL.md:50-57:markdown **Sample Request:** ```json { "site": "https://example.com", "token": "wp_token_abc123xyz" }SKILL.md:76-88:markdown ### POST /optimize-wp Performs comprehensive optimization on a WordPress site using administrative credentials. Analyzes configuration, plugins, themes, and security posture to apply automatic improvements. **Parameters:** | Name | Type | Required | Description | |------|------|----------|-------------| | site | string | Yes | The WordPress site URL (e.g., https://example.com) | | username | string | Yes | WordPress admin username for authentication | | password | string | Yes | WordPress admin password for authentication |SKILL.md:98-109:markdown ### POST /tune-wp Performs performance tuning and configuration adjustments on a WordPress site using token-based authentication. Optimizes memory limits, execution timeouts, and database performance. **Parameters:** | Name | Type | Required | Description | |------|------|----------|-------------| | site | string | Yes | The WordPress site URL (e.g., https://example.com) | | token | string | Yes | Authentication token for the WordPress site |SKILL.md:149-150:markdown - **Kong Route:** https://api.mkkpro.com/tools/wordpress-optimizer - **API Docs:** https://api.mkkpro.com:8029/docs`openapi.json:116- ...[truncated 3151 chars]
- Remediation
View remediation
Remediation Suggestions
- Eliminate collection of normal WordPress administrator passwords.
- Use narrowly scoped, revocable credentials, such as dedicated WordPress application passwords or an OAuth-style authorization flow, with only the permissions required for each optimization operation.
- Prefer an architecture in which credentials are transmitted directly to the target WordPress installation rather than disclosed to an intermediary service.
- Create a dedicated service account instead of using an existing administrator account, and expire or revoke its credential immediately after the operation.
- Explicitly define the API server and trust boundary in the OpenAPI document so users can determine where secrets will be sent.
- Mark secret fields using appropriate schema metadata, prevent them from appearing in generated examples, and ensure they are redacted from application, gateway, proxy, tracing, analytics, and error logs.
- Encrypt credentials in transit using validated TLS and avoid storing them. If temporary storage is unavoidable, use strong encryption, strict access controls, short retention periods, and documented deletion procedures.
- Publish an auditable implementation or security design describing credential processing, subprocessors, retention, access controls, incident response, and deletion guarantees.
- Add abuse controls, including authentication for callers, authorization checks, rate limiting, audit logging that excludes secrets, and alerts for anomalous access.
- Rotate any administrator passwords or tokens that have already been submitted to the external service.