Video yükleniyor...

Video Yüklenemedi

Ana Sayfaya Dön

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

mattjay's profile picture

Matt Johansen

46,024 subscribers

10,021 görüntüleme • 2 ay önce •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

2 Yorum

The CyberSec Guru profil fotoğrafı
The CyberSec Guru2 ay önce

Here's the poc and also technicwk analysis of it:

Sara Blu profil fotoğrafı
Sara Blu2 ay önce

Brutal. Unauth RCE on core with zero plugins needed is as critical as it gets. If you run WordPress, patch right now.

Benzer Videolar

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!
0:26

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!

pwn.ai

120,175 görüntüleme • 19 gün önce

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!
0:44

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

Calif

64,039 görüntüleme • 2 ay önce

🚨 CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation PoC: ▪️Vulnerability Type: Remote Code Execution (RCE) ▪️CVSS: 9.8 ▪️Published: 11/24/2025 Impact: ▪️Full site compromise ▪️Create admin accounts ▪️Install backdoors/malicious files ▪️Redirect visitors or inject malware Credit:
1:17

🚨 CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation PoC: ▪️Vulnerability Type: Remote Code Execution (RCE) ▪️CVSS: 9.8 ▪️Published: 11/24/2025 Impact: ▪️Full site compromise ▪️Create admin accounts ▪️Install backdoors/malicious files ▪️Redirect visitors or inject malware Credit:

Dark Web Informer

16,083 görüntüleme • 9 ay önce

RCE on Xiaomi 13 Pro (CVE-2023-26324) 👉Exploitation: 1) Open URL in WebView 2) Inject JavaScript 3) Execute JavaScript Interface functions from vulnerable GetApps to install & launch payload 4) Get shell Slides with PoC: by Ken Gannon (伊藤 剣) XzX-040 at #DEFCON23
0:25

RCE on Xiaomi 13 Pro (CVE-2023-26324) 👉Exploitation: 1) Open URL in WebView 2) Inject JavaScript 3) Execute JavaScript Interface functions from vulnerable GetApps to install & launch payload 4) Get shell Slides with PoC: by Ken Gannon (伊藤 剣) XzX-040 at #DEFCON23

Mobile Hacker

33,715 görüntüleme • 2 yıl önce

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find
0:41

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

Hacktron AI

40,034 görüntüleme • 2 ay önce

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇
0:53

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇

0xSha

28,781 görüntüleme • 2 ay önce

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇
0:56

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇

Aseem Shrey

33,831 görüntüleme • 2 ay önce

Buckle up, it's about to get Wild 🎟️ on sale NOW » #mnwild | SeatGeek
0:28

Buckle up, it's about to get Wild 🎟️ on sale NOW » #mnwild | SeatGeek

Minnesota Wild

27,661 görüntüleme • 1 ay önce

‼️ OpenClaw, also known by Moltbot and ClawdBot, recently patched a 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVSS: 8.8 Advisory: Writeup: All versions up to v2026.1.24-1 are vulnerable. Video: Ethiack
0:23

‼️ OpenClaw, also known by Moltbot and ClawdBot, recently patched a 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVSS: 8.8 Advisory: Writeup: All versions up to v2026.1.24-1 are vulnerable. Video: Ethiack

Dark Web Informer

18,960 görüntüleme • 8 ay önce

Barstool's Megan is bringing her talents to OnlyFans 👀 Subscribe now, and buckle up:
0:38

Sensitive content

Barstool's Megan is bringing her talents to OnlyFans 👀 Subscribe now, and buckle up:

OnlyFans

310,463 görüntüleme • 2 yıl önce

“King Charles helped turn on a Climate Clock” “The countdown to 2030 begins” Buckle up people it’s going to be a crazy few years with these lunatics trying to install their vision for the future.
1:30

“King Charles helped turn on a Climate Clock” “The countdown to 2030 begins” Buckle up people it’s going to be a crazy few years with these lunatics trying to install their vision for the future.

Concerned Citizen

223,044 görüntüleme • 1 yıl önce

Five minutes was all it took for a police officer to go from a routine buckle-up reminder to stopping a mass shooter who’d already claimed 8 lives 🙏🏻
5:12

Five minutes was all it took for a police officer to go from a routine buckle-up reminder to stopping a mass shooter who’d already claimed 8 lives 🙏🏻

Insane Reality Leaks

9,271,994 görüntüleme • 2 yıl önce

buckle up to witness the ultimate action-packed battle between the good and evil 💥 #PathuThalaOnPrime, watch now
0:30

buckle up to witness the ultimate action-packed battle between the good and evil 💥 #PathuThalaOnPrime, watch now

prime video IN

230,051 görüntüleme • 3 yıl önce

Buckle up for an adrenaline rush like no other. Get tickets to see The Running Man in theatres now!
0:11

Buckle up for an adrenaline rush like no other. Get tickets to see The Running Man in theatres now!

The Running Man Movie

1,705,230 görüntüleme • 10 ay önce

Buckle up, it’s going to be a bumpy flight. 💫 Get your tickets to #Superman - only in theaters July 11 NOW:
0:30

Buckle up, it’s going to be a bumpy flight. 💫 Get your tickets to #Superman - only in theaters July 11 NOW:

Superman

122,135 görüntüleme • 1 yıl önce

Fly the friendly skies with TOOCHI KA$H ONLYFANS ⬇️ 🚀 Buckle up... and tune in to #IRL—now streaming free! 📺 Watch now:
0:47

Fly the friendly skies with TOOCHI KA$H ONLYFANS ⬇️ 🚀 Buckle up... and tune in to #IRL—now streaming free! 📺 Watch now:

OFTV

486,017 görüntüleme • 1 yıl önce

ZERO Democrats showed up to our discussion on unaccompanied alien children. Again. Rep. Eli Crane: "I don't really think they care much." Children were left vulnerable to cartels, forced labor, and sexual exploitation under Biden. Not a single Democrat bothered to show.
0:33

ZERO Democrats showed up to our discussion on unaccompanied alien children. Again. Rep. Eli Crane: "I don't really think they care much." Children were left vulnerable to cartels, forced labor, and sexual exploitation under Biden. Not a single Democrat bothered to show.

Oversight Committee

98,127 görüntüleme • 1 ay önce

"BACK THERE NOW" IS OUT....THERE NOW!!!! 😈😈😈 BUCKLE UP!!!! CB IS BACK!!!!!!! stream now and buy tickets to the forever and ever tour💘💘💘:
0:23

"BACK THERE NOW" IS OUT....THERE NOW!!!! 😈😈😈 BUCKLE UP!!!! CB IS BACK!!!!!!! stream now and buy tickets to the forever and ever tour💘💘💘:

Charly Bliss

22,380 görüntüleme • 2 yıl önce

PES ‘99 is OUT NOW Available via Patreon for $14 Remember, it’s a patch for efootball PES 2021, but we have some additional help on how to install and set it up (even maybe how to get hold of PES 2021) all via our discord channel All links are in the next post
1:52

PES ‘99 is OUT NOW Available via Patreon for $14 Remember, it’s a patch for efootball PES 2021, but we have some additional help on how to install and set it up (even maybe how to get hold of PES 2021) all via our discord channel All links are in the next post

PES '99

406,930 görüntüleme • 7 ay önce