Loading video...

Video Failed to Load

Go Home

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

mattjay's profile picture

Matt Johansen

46,024 subscribers

10,021 views • 2 months ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

2 Comments

The CyberSec Guru's profile picture
The CyberSec Guru2 months ago

Here's the poc and also technicwk analysis of it:

Sara Blu's profile picture
Sara Blu2 months ago

Brutal. Unauth RCE on core with zero plugins needed is as critical as it gets. If you run WordPress, patch right now.

Related Videos

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!
0:26

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!

pwn.ai

120,175 views • 19 days ago

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!
0:44

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

Calif

64,039 views • 2 months ago

🚨 CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation PoC: ▪️Vulnerability Type: Remote Code Execution (RCE) ▪️CVSS: 9.8 ▪️Published: 11/24/2025 Impact: ▪️Full site compromise ▪️Create admin accounts ▪️Install backdoors/malicious files ▪️Redirect visitors or inject malware Credit:
1:17

🚨 CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation PoC: ▪️Vulnerability Type: Remote Code Execution (RCE) ▪️CVSS: 9.8 ▪️Published: 11/24/2025 Impact: ▪️Full site compromise ▪️Create admin accounts ▪️Install backdoors/malicious files ▪️Redirect visitors or inject malware Credit:

Dark Web Informer

16,083 views • 9 months ago

RCE on Xiaomi 13 Pro (CVE-2023-26324) 👉Exploitation: 1) Open URL in WebView 2) Inject JavaScript 3) Execute JavaScript Interface functions from vulnerable GetApps to install & launch payload 4) Get shell Slides with PoC: by Ken Gannon (伊藤 剣) XzX-040 at #DEFCON23
0:25

RCE on Xiaomi 13 Pro (CVE-2023-26324) 👉Exploitation: 1) Open URL in WebView 2) Inject JavaScript 3) Execute JavaScript Interface functions from vulnerable GetApps to install & launch payload 4) Get shell Slides with PoC: by Ken Gannon (伊藤 剣) XzX-040 at #DEFCON23

Mobile Hacker

33,715 views • 2 years ago

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find
0:41

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

Hacktron AI

40,034 views • 2 months ago

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇
0:53

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇

0xSha

28,781 views • 2 months ago

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇
0:56

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇

Aseem Shrey

33,831 views • 2 months ago

Buckle up, it's about to get Wild 🎟️ on sale NOW » #mnwild | SeatGeek
0:28

Buckle up, it's about to get Wild 🎟️ on sale NOW » #mnwild | SeatGeek

Minnesota Wild

27,661 views • 1 month ago

‼️ OpenClaw, also known by Moltbot and ClawdBot, recently patched a 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVSS: 8.8 Advisory: Writeup: All versions up to v2026.1.24-1 are vulnerable. Video: Ethiack
0:23

‼️ OpenClaw, also known by Moltbot and ClawdBot, recently patched a 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVSS: 8.8 Advisory: Writeup: All versions up to v2026.1.24-1 are vulnerable. Video: Ethiack

Dark Web Informer

18,960 views • 8 months ago

Barstool's Megan is bringing her talents to OnlyFans 👀 Subscribe now, and buckle up:
0:38

Sensitive content

Barstool's Megan is bringing her talents to OnlyFans 👀 Subscribe now, and buckle up:

OnlyFans

310,463 views • 2 years ago

“King Charles helped turn on a Climate Clock” “The countdown to 2030 begins” Buckle up people it’s going to be a crazy few years with these lunatics trying to install their vision for the future.
1:30

“King Charles helped turn on a Climate Clock” “The countdown to 2030 begins” Buckle up people it’s going to be a crazy few years with these lunatics trying to install their vision for the future.

Concerned Citizen

223,044 views • 1 year ago

Five minutes was all it took for a police officer to go from a routine buckle-up reminder to stopping a mass shooter who’d already claimed 8 lives 🙏🏻
5:12

Five minutes was all it took for a police officer to go from a routine buckle-up reminder to stopping a mass shooter who’d already claimed 8 lives 🙏🏻

Insane Reality Leaks

9,271,994 views • 2 years ago

buckle up to witness the ultimate action-packed battle between the good and evil 💥 #PathuThalaOnPrime, watch now
0:30

buckle up to witness the ultimate action-packed battle between the good and evil 💥 #PathuThalaOnPrime, watch now

prime video IN

230,051 views • 3 years ago

Buckle up for an adrenaline rush like no other. Get tickets to see The Running Man in theatres now!
0:11

Buckle up for an adrenaline rush like no other. Get tickets to see The Running Man in theatres now!

The Running Man Movie

1,705,230 views • 10 months ago

Buckle up, it’s going to be a bumpy flight. 💫 Get your tickets to #Superman - only in theaters July 11 NOW:
0:30

Buckle up, it’s going to be a bumpy flight. 💫 Get your tickets to #Superman - only in theaters July 11 NOW:

Superman

122,135 views • 1 year ago

Fly the friendly skies with TOOCHI KA$H ONLYFANS ⬇️ 🚀 Buckle up... and tune in to #IRL—now streaming free! 📺 Watch now:
0:47

Fly the friendly skies with TOOCHI KA$H ONLYFANS ⬇️ 🚀 Buckle up... and tune in to #IRL—now streaming free! 📺 Watch now:

OFTV

486,017 views • 1 year ago

ZERO Democrats showed up to our discussion on unaccompanied alien children. Again. Rep. Eli Crane: "I don't really think they care much." Children were left vulnerable to cartels, forced labor, and sexual exploitation under Biden. Not a single Democrat bothered to show.
0:33

ZERO Democrats showed up to our discussion on unaccompanied alien children. Again. Rep. Eli Crane: "I don't really think they care much." Children were left vulnerable to cartels, forced labor, and sexual exploitation under Biden. Not a single Democrat bothered to show.

Oversight Committee

98,127 views • 1 month ago

"BACK THERE NOW" IS OUT....THERE NOW!!!! 😈😈😈 BUCKLE UP!!!! CB IS BACK!!!!!!! stream now and buy tickets to the forever and ever tour💘💘💘:
0:23

"BACK THERE NOW" IS OUT....THERE NOW!!!! 😈😈😈 BUCKLE UP!!!! CB IS BACK!!!!!!! stream now and buy tickets to the forever and ever tour💘💘💘:

Charly Bliss

22,380 views • 2 years ago

PES ‘99 is OUT NOW Available via Patreon for $14 Remember, it’s a patch for efootball PES 2021, but we have some additional help on how to install and set it up (even maybe how to get hold of PES 2021) all via our discord channel All links are in the next post
1:52

PES ‘99 is OUT NOW Available via Patreon for $14 Remember, it’s a patch for efootball PES 2021, but we have some additional help on how to install and set it up (even maybe how to get hold of PES 2021) all via our discord channel All links are in the next post

PES '99

406,930 views • 7 months ago