Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

mattjay's profile picture

Matt Johansen

46,024 subscribers

10,021 Aufrufe • vor 2 Monaten •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

2 Kommentare

Profilbild von The CyberSec Guru
The CyberSec Guruvor 2 Monaten

Here's the poc and also technicwk analysis of it:

Profilbild von Sara Blu
Sara Bluvor 2 Monaten

Brutal. Unauth RCE on core with zero plugins needed is as critical as it gets. If you run WordPress, patch right now.

Ähnliche Videos

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!
0:26

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!

pwn.ai

120,175 Aufrufe • vor 19 Tagen

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!
0:44

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

Calif

64,039 Aufrufe • vor 2 Monaten

🚨 CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation PoC: ▪️Vulnerability Type: Remote Code Execution (RCE) ▪️CVSS: 9.8 ▪️Published: 11/24/2025 Impact: ▪️Full site compromise ▪️Create admin accounts ▪️Install backdoors/malicious files ▪️Redirect visitors or inject malware Credit:
1:17

🚨 CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation PoC: ▪️Vulnerability Type: Remote Code Execution (RCE) ▪️CVSS: 9.8 ▪️Published: 11/24/2025 Impact: ▪️Full site compromise ▪️Create admin accounts ▪️Install backdoors/malicious files ▪️Redirect visitors or inject malware Credit:

Dark Web Informer

16,083 Aufrufe • vor 9 Monaten

RCE on Xiaomi 13 Pro (CVE-2023-26324) 👉Exploitation: 1) Open URL in WebView 2) Inject JavaScript 3) Execute JavaScript Interface functions from vulnerable GetApps to install & launch payload 4) Get shell Slides with PoC: by Ken Gannon (伊藤 剣) XzX-040 at #DEFCON23
0:25

RCE on Xiaomi 13 Pro (CVE-2023-26324) 👉Exploitation: 1) Open URL in WebView 2) Inject JavaScript 3) Execute JavaScript Interface functions from vulnerable GetApps to install & launch payload 4) Get shell Slides with PoC: by Ken Gannon (伊藤 剣) XzX-040 at #DEFCON23

Mobile Hacker

33,715 Aufrufe • vor 2 Jahren

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find
0:41

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

Hacktron AI

40,034 Aufrufe • vor 2 Monaten

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇
0:53

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇

0xSha

28,781 Aufrufe • vor 2 Monaten

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇
0:56

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇

Aseem Shrey

33,831 Aufrufe • vor 2 Monaten

Buckle up, it's about to get Wild 🎟️ on sale NOW » #mnwild | SeatGeek
0:28

Buckle up, it's about to get Wild 🎟️ on sale NOW » #mnwild | SeatGeek

Minnesota Wild

27,661 Aufrufe • vor 1 Monat

‼️ OpenClaw, also known by Moltbot and ClawdBot, recently patched a 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVSS: 8.8 Advisory: Writeup: All versions up to v2026.1.24-1 are vulnerable. Video: Ethiack
0:23

‼️ OpenClaw, also known by Moltbot and ClawdBot, recently patched a 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVSS: 8.8 Advisory: Writeup: All versions up to v2026.1.24-1 are vulnerable. Video: Ethiack

Dark Web Informer

18,960 Aufrufe • vor 8 Monaten

Barstool's Megan is bringing her talents to OnlyFans 👀 Subscribe now, and buckle up:
0:38

Sensitive content

Barstool's Megan is bringing her talents to OnlyFans 👀 Subscribe now, and buckle up:

OnlyFans

310,463 Aufrufe • vor 2 Jahren

“King Charles helped turn on a Climate Clock” “The countdown to 2030 begins” Buckle up people it’s going to be a crazy few years with these lunatics trying to install their vision for the future.
1:30

“King Charles helped turn on a Climate Clock” “The countdown to 2030 begins” Buckle up people it’s going to be a crazy few years with these lunatics trying to install their vision for the future.

Concerned Citizen

223,044 Aufrufe • vor 1 Jahr

Five minutes was all it took for a police officer to go from a routine buckle-up reminder to stopping a mass shooter who’d already claimed 8 lives 🙏🏻
5:12

Five minutes was all it took for a police officer to go from a routine buckle-up reminder to stopping a mass shooter who’d already claimed 8 lives 🙏🏻

Insane Reality Leaks

9,271,994 Aufrufe • vor 2 Jahren

buckle up to witness the ultimate action-packed battle between the good and evil 💥 #PathuThalaOnPrime, watch now
0:30

buckle up to witness the ultimate action-packed battle between the good and evil 💥 #PathuThalaOnPrime, watch now

prime video IN

230,051 Aufrufe • vor 3 Jahren

Buckle up for an adrenaline rush like no other. Get tickets to see The Running Man in theatres now!
0:11

Buckle up for an adrenaline rush like no other. Get tickets to see The Running Man in theatres now!

The Running Man Movie

1,705,230 Aufrufe • vor 10 Monaten

Buckle up, it’s going to be a bumpy flight. 💫 Get your tickets to #Superman - only in theaters July 11 NOW:
0:30

Buckle up, it’s going to be a bumpy flight. 💫 Get your tickets to #Superman - only in theaters July 11 NOW:

Superman

122,135 Aufrufe • vor 1 Jahr

Fly the friendly skies with TOOCHI KA$H ONLYFANS ⬇️ 🚀 Buckle up... and tune in to #IRL—now streaming free! 📺 Watch now:
0:47

Fly the friendly skies with TOOCHI KA$H ONLYFANS ⬇️ 🚀 Buckle up... and tune in to #IRL—now streaming free! 📺 Watch now:

OFTV

486,017 Aufrufe • vor 1 Jahr

ZERO Democrats showed up to our discussion on unaccompanied alien children. Again. Rep. Eli Crane: "I don't really think they care much." Children were left vulnerable to cartels, forced labor, and sexual exploitation under Biden. Not a single Democrat bothered to show.
0:33

ZERO Democrats showed up to our discussion on unaccompanied alien children. Again. Rep. Eli Crane: "I don't really think they care much." Children were left vulnerable to cartels, forced labor, and sexual exploitation under Biden. Not a single Democrat bothered to show.

Oversight Committee

98,127 Aufrufe • vor 1 Monat

"BACK THERE NOW" IS OUT....THERE NOW!!!! 😈😈😈 BUCKLE UP!!!! CB IS BACK!!!!!!! stream now and buy tickets to the forever and ever tour💘💘💘:
0:23

"BACK THERE NOW" IS OUT....THERE NOW!!!! 😈😈😈 BUCKLE UP!!!! CB IS BACK!!!!!!! stream now and buy tickets to the forever and ever tour💘💘💘:

Charly Bliss

22,380 Aufrufe • vor 2 Jahren

PES ‘99 is OUT NOW Available via Patreon for $14 Remember, it’s a patch for efootball PES 2021, but we have some additional help on how to install and set it up (even maybe how to get hold of PES 2021) all via our discord channel All links are in the next post
1:52

PES ‘99 is OUT NOW Available via Patreon for $14 Remember, it’s a patch for efootball PES 2021, but we have some additional help on how to install and set it up (even maybe how to get hold of PES 2021) all via our discord channel All links are in the next post

PES '99

406,930 Aufrufe • vor 7 Monaten