class Analyzer::Php::Wordpress

• Analyzer::Php::Wordpress
• Analyzer::Php::PhpEngine
• Analyzer
• Reference
• Object

Overview

WordPress attack-surface extractor.

WordPress does not expose a conventional route table; its HTTP surface is registered imperatively through a handful of well-known APIs:

• REST API — register_rest_route( $namespace, $route, $args ) served under /wp-json/{namespace}/{route}.
• Admin AJAX — add_action( 'wp_ajax_{action}', ... ) and the public wp_ajax_nopriv_{action} variant, dispatched by /wp-admin/admin-ajax.php?action={action}.
• Admin POST — add_action( 'admin_post_{action}', ... ) / admin_post_nopriv_{action}, dispatched by /wp-admin/admin-post.php?action={action}.

Defined in:

Constant Summary

ADMIN_AJAX_PATH = "/wp-admin/admin-ajax.php"

ADMIN_POST_PATH = "/wp-admin/admin-post.php"

ALL_HTTP_VERBS = ["GET", "POST", "PUT", "PATCH", "DELETE"]

DISPATCH_METHODS = ["GET", "POST"]

WordPress admin-ajax / admin-post dispatch on $_REQUEST['action'], so both verbs are valid entry points.

REST_METHOD_CONSTANTS = {"READABLE" => ["GET"], "CREATABLE" => ["POST"], "EDITABLE" => ["POST", "PUT", "PATCH"], "DELETABLE" => ["DELETE"], "ALLMETHODS" => ["GET", "POST", "PUT", "PATCH", "DELETE"]}

WP_REST_Server:: method-group constants → concrete HTTP verbs.

Instance Method Summary

• #analyze_file(path : String) : Array(Endpoint)

Instance Method Detail