Загрузка видео...

Не удалось загрузить видео

На главную

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

mattjay's profile picture

Matt Johansen

46,024 subscribers

10,021 просмотров • 2 месяцев назад •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

Комментарии: 2

Фото профиля The CyberSec Guru
The CyberSec Guru2 месяцев назад

Here's the poc and also technicwk analysis of it:

Фото профиля Sara Blu
Sara Blu2 месяцев назад

Brutal. Unauth RCE on core with zero plugins needed is as critical as it gets. If you run WordPress, patch right now.

Похожие видео

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!
0:26

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!

pwn.ai

120,175 просмотров • 19 дней назад

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!
0:44

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

Calif

64,039 просмотров • 2 месяцев назад

🚨 CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation PoC: ▪️Vulnerability Type: Remote Code Execution (RCE) ▪️CVSS: 9.8 ▪️Published: 11/24/2025 Impact: ▪️Full site compromise ▪️Create admin accounts ▪️Install backdoors/malicious files ▪️Redirect visitors or inject malware Credit:
1:17

🚨 CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation PoC: ▪️Vulnerability Type: Remote Code Execution (RCE) ▪️CVSS: 9.8 ▪️Published: 11/24/2025 Impact: ▪️Full site compromise ▪️Create admin accounts ▪️Install backdoors/malicious files ▪️Redirect visitors or inject malware Credit:

Dark Web Informer

16,083 просмотров • 9 месяцев назад

RCE on Xiaomi 13 Pro (CVE-2023-26324) 👉Exploitation: 1) Open URL in WebView 2) Inject JavaScript 3) Execute JavaScript Interface functions from vulnerable GetApps to install & launch payload 4) Get shell Slides with PoC: by Ken Gannon (伊藤 剣) XzX-040 at #DEFCON23
0:25

RCE on Xiaomi 13 Pro (CVE-2023-26324) 👉Exploitation: 1) Open URL in WebView 2) Inject JavaScript 3) Execute JavaScript Interface functions from vulnerable GetApps to install & launch payload 4) Get shell Slides with PoC: by Ken Gannon (伊藤 剣) XzX-040 at #DEFCON23

Mobile Hacker

33,715 просмотров • 2 лет назад

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find
0:41

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

Hacktron AI

40,034 просмотров • 2 месяцев назад

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇
0:53

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇

0xSha

28,781 просмотров • 2 месяцев назад

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇
0:56

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇

Aseem Shrey

33,831 просмотров • 2 месяцев назад

Buckle up, it's about to get Wild 🎟️ on sale NOW » #mnwild | SeatGeek
0:28

Buckle up, it's about to get Wild 🎟️ on sale NOW » #mnwild | SeatGeek

Minnesota Wild

27,661 просмотров • 1 месяц назад

‼️ OpenClaw, also known by Moltbot and ClawdBot, recently patched a 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVSS: 8.8 Advisory: Writeup: All versions up to v2026.1.24-1 are vulnerable. Video: Ethiack
0:23

‼️ OpenClaw, also known by Moltbot and ClawdBot, recently patched a 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVSS: 8.8 Advisory: Writeup: All versions up to v2026.1.24-1 are vulnerable. Video: Ethiack

Dark Web Informer

18,960 просмотров • 8 месяцев назад

Barstool's Megan is bringing her talents to OnlyFans 👀 Subscribe now, and buckle up:
0:38

Sensitive content

Barstool's Megan is bringing her talents to OnlyFans 👀 Subscribe now, and buckle up:

OnlyFans

310,463 просмотров • 2 лет назад

“King Charles helped turn on a Climate Clock” “The countdown to 2030 begins” Buckle up people it’s going to be a crazy few years with these lunatics trying to install their vision for the future.
1:30

“King Charles helped turn on a Climate Clock” “The countdown to 2030 begins” Buckle up people it’s going to be a crazy few years with these lunatics trying to install their vision for the future.

Concerned Citizen

223,044 просмотров • 1 год назад

Five minutes was all it took for a police officer to go from a routine buckle-up reminder to stopping a mass shooter who’d already claimed 8 lives 🙏🏻
5:12

Five minutes was all it took for a police officer to go from a routine buckle-up reminder to stopping a mass shooter who’d already claimed 8 lives 🙏🏻

Insane Reality Leaks

9,271,994 просмотров • 2 лет назад

buckle up to witness the ultimate action-packed battle between the good and evil 💥 #PathuThalaOnPrime, watch now
0:30

buckle up to witness the ultimate action-packed battle between the good and evil 💥 #PathuThalaOnPrime, watch now

prime video IN

230,051 просмотров • 3 лет назад

Buckle up for an adrenaline rush like no other. Get tickets to see The Running Man in theatres now!
0:11

Buckle up for an adrenaline rush like no other. Get tickets to see The Running Man in theatres now!

The Running Man Movie

1,705,230 просмотров • 10 месяцев назад

Buckle up, it’s going to be a bumpy flight. 💫 Get your tickets to #Superman - only in theaters July 11 NOW:
0:30

Buckle up, it’s going to be a bumpy flight. 💫 Get your tickets to #Superman - only in theaters July 11 NOW:

Superman

122,135 просмотров • 1 год назад

Fly the friendly skies with TOOCHI KA$H ONLYFANS ⬇️ 🚀 Buckle up... and tune in to #IRL—now streaming free! 📺 Watch now:
0:47

Fly the friendly skies with TOOCHI KA$H ONLYFANS ⬇️ 🚀 Buckle up... and tune in to #IRL—now streaming free! 📺 Watch now:

OFTV

486,017 просмотров • 1 год назад

ZERO Democrats showed up to our discussion on unaccompanied alien children. Again. Rep. Eli Crane: "I don't really think they care much." Children were left vulnerable to cartels, forced labor, and sexual exploitation under Biden. Not a single Democrat bothered to show.
0:33

ZERO Democrats showed up to our discussion on unaccompanied alien children. Again. Rep. Eli Crane: "I don't really think they care much." Children were left vulnerable to cartels, forced labor, and sexual exploitation under Biden. Not a single Democrat bothered to show.

Oversight Committee

98,127 просмотров • 1 месяц назад

"BACK THERE NOW" IS OUT....THERE NOW!!!! 😈😈😈 BUCKLE UP!!!! CB IS BACK!!!!!!! stream now and buy tickets to the forever and ever tour💘💘💘:
0:23

"BACK THERE NOW" IS OUT....THERE NOW!!!! 😈😈😈 BUCKLE UP!!!! CB IS BACK!!!!!!! stream now and buy tickets to the forever and ever tour💘💘💘:

Charly Bliss

22,380 просмотров • 2 лет назад

PES ‘99 is OUT NOW Available via Patreon for $14 Remember, it’s a patch for efootball PES 2021, but we have some additional help on how to install and set it up (even maybe how to get hold of PES 2021) all via our discord channel All links are in the next post
1:52

PES ‘99 is OUT NOW Available via Patreon for $14 Remember, it’s a patch for efootball PES 2021, but we have some additional help on how to install and set it up (even maybe how to get hold of PES 2021) all via our discord channel All links are in the next post

PES '99

406,930 просмотров • 7 месяцев назад