Wordpress Alert: Application-password exposure

What it looks like

A WordPress application password appears in logs, backups, or a public repository.

Why it matters

An external client may gain API access with that credential.

What to check

Audit where application passwords are stored and revoke exposed ones.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WordPress REST authentication, WordPress hardening guide.