hunt-wordpress
Use when an authorized target exposes WordPress core, plugin, theme, REST, or XML-RPC behavior.