How to Run a Passive Security Audit on Any WordPress Site
You don't need to exploit anything to find real security problems on a WordPress site. Here's a practical, non-destructive audit workflow using curl, your browser, and a few targeted requests.