Terms of use
& disclaimer

1. What this software is

"hwp" (also referred to as HackWP or the "Software") is a free and open-source WordPress exploitation framework. It contains working exploit modules, payloads, a vulnerability scanner and delivery adapters. It is published for two purposes, and only two:

• Authorized penetration testing — assessments performed with the documented, prior permission of the system owner.
• Security education and research — learning, training and experimentation in a controlled environment that you own or are entitled to use, such as a local lab, a deliberately vulnerable virtual machine, or a capture-the-flag event you are registered for.

"You" means any person or organisation that downloads, installs, runs, copies, modifies or otherwise uses the Software. By doing any of those things you accept these terms.

2. Authorized use only

You represent and warrant that, for every target you point the Software at, at least one of the following is true:

• You own the target system outright, and no third party's data or service depends on it in a way you are not entitled to affect.
• You hold explicit, written, current authorization from the system owner that covers the specific target, the testing window and the techniques used — for example a signed statement of work, a rules-of-engagement document, or a bug bounty programme's published scope.
• The target is a purpose-built training environment (your own lab, a vulnerable-by-design image, a sanctioned CTF) where exploitation is the intended activity.

Verbal permission, an implied invitation, a public IP address, a "responsible disclosure" page with no scope, or a belief that the owner "wouldn't mind" are not authorization. If you are unsure whether you are authorized, you are not authorized.

Authorization is not transferable. Permission to test one host does not extend to adjacent hosts, shared hosting neighbours, upstream providers, CDNs, or any third-party service the target depends on.

3. Prohibited use

You must not use the Software to:

• Access, scan, probe, disrupt or interfere with any system without the authorization described in section 2 — including "just checking" whether a target is vulnerable, which is itself unauthorized access in most jurisdictions.
• Commit any criminal offence, or to assist anyone else in doing so.
• Steal, exfiltrate, ransom, destroy or expose data belonging to anyone else.
• Establish persistence, deploy malware, mine cryptocurrency, send spam, or otherwise abuse a system you have gained access to, whether or not the initial access was authorized.
• Harass, extort, dox or intimidate any person or organisation.
• Exceed the scope, timing or technique limits of an engagement you are otherwise authorized to perform.

4. No warranty

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT.

No guarantee is made that the Software is correct, complete, current, reliable, secure, or fit for any purpose; that any exploit module works, works safely, or works as described; that results are accurate or free of false positives and false negatives; or that use of the Software will not damage the target, your own machine, or anything in between. You assume the entire risk as to quality and performance.

5. Limitation of liability

IN NO EVENT SHALL THE AUTHORS, COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY — WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE — ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. This includes, without limitation, direct, indirect, incidental, special, exemplary or consequential damages; loss of data, profits, revenue, goodwill or business; service interruption; system damage; regulatory fines; and legal costs.

You are solely responsible for your actions and for every consequence of using the Software. You agree to indemnify and hold harmless the authors, copyright holders and contributors against any claim, demand, loss or expense arising from your use of it, including your breach of these terms or of any applicable law.

Nothing in these terms excludes or limits liability to the extent that such exclusion or limitation is not permitted by applicable law.

6. Destructive by nature

Exploitation is not a read-only activity. Modules in this Software write files, modify database rows, create users, delete or overwrite content, and execute code on the target. Any of that can corrupt data, break a site, trip a WAF, page an on-call engineer, or take a production system offline — including by accident, including on a module that has worked fine a hundred times before.

Treat every run as irreversible. Take a backup and a snapshot before you start, agree a rollback plan with the system owner, and never run the Software against anything you cannot afford to restore from scratch.

7. Vulnerability content & disclosure

Exploit modules reference publicly disclosed vulnerabilities in third-party WordPress plugins, themes and core. References to CVE identifiers, plugin names, version ranges and original researchers are provided for identification and attribution. No affiliation with, or endorsement by, any referenced project, vendor or researcher is claimed or implied. WordPress® is a registered trademark of the WordPress Foundation; this project is not affiliated with or endorsed by the WordPress Foundation or Automattic.

If you discover a previously unknown vulnerability while using this Software, report it to the affected vendor or maintainer before publishing it. Finding a bug does not entitle you to exploit it outside the scope of your authorization.

If you are a maintainer and believe a module in this project contains an error, or discloses something that should not yet be public, please open an issue.

8. Licence

The Software is licensed under the GNU General Public License v3.0. Your rights to use, modify and redistribute it are granted by that licence, and the warranty disclaimer and liability limitation in sections 15 and 16 of the GPL apply in full. Where these terms and the GPL differ on the subject of copying, modification or redistribution, the GPL governs; these terms set out the conditions of acceptable use, which the licence does not address.

Copyright © 2024–2026 @etragardh.

9. Law, jurisdiction & export

Unauthorized access to, or interference with, computer systems and data is a criminal offence in most jurisdictions — including, for example, under the Computer Fraud and Abuse Act in the United States, the Computer Misuse Act 1990 in the United Kingdom, and equivalent provisions across the European Union and elsewhere. Penalties commonly include imprisonment.

You are responsible for knowing and complying with every law that applies to you, to your target, and to the networks in between — including laws on computer misuse, data protection, wiretapping, and the export or possession of security tooling, which in some jurisdictions is itself restricted.

These terms are not legal advice. If you need to know whether a specific activity is lawful where you are, consult a qualified lawyer, not a website with a skull on it.

10. Privacy

This website is static. It sets no cookies, runs no analytics, embeds no third-party scripts, fonts or trackers, and collects no personal data. Your web server's standard access logs are the only record that you visited.

The Software itself sends no telemetry and requires no account. It stores scan results and sessions locally under ~/.hackwp/ on your own machine. Note that those files can contain credentials, session cookies and details of target systems — protect them accordingly, and clear them when an engagement ends.

11. Changes & contact

These terms may be updated as the project evolves; the version in effect is the one published at hackwp.io/legal.html at the time you use the Software. Material changes will be reflected in the "last updated" date above.

Questions, corrections or takedown requests: open an issue on GitHub.