正在加载视频...

视频加载失败

返回首页

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

mattjay's profile picture

Matt Johansen

46,024 subscribers

10,021 次观看 • 2 个月前 •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

2 条评论

The CyberSec Guru 的头像
The CyberSec Guru2 个月前

Here's the poc and also technicwk analysis of it:

Sara Blu 的头像
Sara Blu2 个月前

Brutal. Unauth RCE on core with zero plugins needed is as critical as it gets. If you run WordPress, patch right now.

相关视频

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!
0:26

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!

pwn.ai

120,175 次观看 • 19 天前

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!
0:44

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

Calif

64,039 次观看 • 2 个月前

🚨 CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation PoC: ▪️Vulnerability Type: Remote Code Execution (RCE) ▪️CVSS: 9.8 ▪️Published: 11/24/2025 Impact: ▪️Full site compromise ▪️Create admin accounts ▪️Install backdoors/malicious files ▪️Redirect visitors or inject malware Credit:
1:17

🚨 CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation PoC: ▪️Vulnerability Type: Remote Code Execution (RCE) ▪️CVSS: 9.8 ▪️Published: 11/24/2025 Impact: ▪️Full site compromise ▪️Create admin accounts ▪️Install backdoors/malicious files ▪️Redirect visitors or inject malware Credit:

Dark Web Informer

16,083 次观看 • 9 个月前

RCE on Xiaomi 13 Pro (CVE-2023-26324) 👉Exploitation: 1) Open URL in WebView 2) Inject JavaScript 3) Execute JavaScript Interface functions from vulnerable GetApps to install & launch payload 4) Get shell Slides with PoC: by Ken Gannon (伊藤 剣) XzX-040 at #DEFCON23
0:25

RCE on Xiaomi 13 Pro (CVE-2023-26324) 👉Exploitation: 1) Open URL in WebView 2) Inject JavaScript 3) Execute JavaScript Interface functions from vulnerable GetApps to install & launch payload 4) Get shell Slides with PoC: by Ken Gannon (伊藤 剣) XzX-040 at #DEFCON23

Mobile Hacker

33,715 次观看 • 2 年前

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find
0:41

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

Hacktron AI

40,034 次观看 • 2 个月前

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇
0:53

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇

0xSha

28,781 次观看 • 2 个月前

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇
0:56

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇

Aseem Shrey

33,831 次观看 • 2 个月前

Buckle up, it's about to get Wild 🎟️ on sale NOW » #mnwild | SeatGeek
0:28

Buckle up, it's about to get Wild 🎟️ on sale NOW » #mnwild | SeatGeek

Minnesota Wild

27,661 次观看 • 1 个月前

‼️ OpenClaw, also known by Moltbot and ClawdBot, recently patched a 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVSS: 8.8 Advisory: Writeup: All versions up to v2026.1.24-1 are vulnerable. Video: Ethiack
0:23

‼️ OpenClaw, also known by Moltbot and ClawdBot, recently patched a 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVSS: 8.8 Advisory: Writeup: All versions up to v2026.1.24-1 are vulnerable. Video: Ethiack

Dark Web Informer

18,960 次观看 • 8 个月前

Barstool's Megan is bringing her talents to OnlyFans 👀 Subscribe now, and buckle up:
0:38

Sensitive content

Barstool's Megan is bringing her talents to OnlyFans 👀 Subscribe now, and buckle up:

OnlyFans

310,463 次观看 • 2 年前

“King Charles helped turn on a Climate Clock” “The countdown to 2030 begins” Buckle up people it’s going to be a crazy few years with these lunatics trying to install their vision for the future.
1:30

“King Charles helped turn on a Climate Clock” “The countdown to 2030 begins” Buckle up people it’s going to be a crazy few years with these lunatics trying to install their vision for the future.

Concerned Citizen

223,044 次观看 • 1 年前

Five minutes was all it took for a police officer to go from a routine buckle-up reminder to stopping a mass shooter who’d already claimed 8 lives 🙏🏻
5:12

Five minutes was all it took for a police officer to go from a routine buckle-up reminder to stopping a mass shooter who’d already claimed 8 lives 🙏🏻

Insane Reality Leaks

9,271,994 次观看 • 2 年前

buckle up to witness the ultimate action-packed battle between the good and evil 💥 #PathuThalaOnPrime, watch now
0:30

buckle up to witness the ultimate action-packed battle between the good and evil 💥 #PathuThalaOnPrime, watch now

prime video IN

230,051 次观看 • 3 年前

Buckle up for an adrenaline rush like no other. Get tickets to see The Running Man in theatres now!
0:11

Buckle up for an adrenaline rush like no other. Get tickets to see The Running Man in theatres now!

The Running Man Movie

1,705,230 次观看 • 10 个月前

Buckle up, it’s going to be a bumpy flight. 💫 Get your tickets to #Superman - only in theaters July 11 NOW:
0:30

Buckle up, it’s going to be a bumpy flight. 💫 Get your tickets to #Superman - only in theaters July 11 NOW:

Superman

122,135 次观看 • 1 年前

Fly the friendly skies with TOOCHI KA$H ONLYFANS ⬇️ 🚀 Buckle up... and tune in to #IRL—now streaming free! 📺 Watch now:
0:47

Fly the friendly skies with TOOCHI KA$H ONLYFANS ⬇️ 🚀 Buckle up... and tune in to #IRL—now streaming free! 📺 Watch now:

OFTV

486,017 次观看 • 1 年前

ZERO Democrats showed up to our discussion on unaccompanied alien children. Again. Rep. Eli Crane: "I don't really think they care much." Children were left vulnerable to cartels, forced labor, and sexual exploitation under Biden. Not a single Democrat bothered to show.
0:33

ZERO Democrats showed up to our discussion on unaccompanied alien children. Again. Rep. Eli Crane: "I don't really think they care much." Children were left vulnerable to cartels, forced labor, and sexual exploitation under Biden. Not a single Democrat bothered to show.

Oversight Committee

98,127 次观看 • 1 个月前

"BACK THERE NOW" IS OUT....THERE NOW!!!! 😈😈😈 BUCKLE UP!!!! CB IS BACK!!!!!!! stream now and buy tickets to the forever and ever tour💘💘💘:
0:23

"BACK THERE NOW" IS OUT....THERE NOW!!!! 😈😈😈 BUCKLE UP!!!! CB IS BACK!!!!!!! stream now and buy tickets to the forever and ever tour💘💘💘:

Charly Bliss

22,380 次观看 • 2 年前

PES ‘99 is OUT NOW Available via Patreon for $14 Remember, it’s a patch for efootball PES 2021, but we have some additional help on how to install and set it up (even maybe how to get hold of PES 2021) all via our discord channel All links are in the next post
1:52

PES ‘99 is OUT NOW Available via Patreon for $14 Remember, it’s a patch for efootball PES 2021, but we have some additional help on how to install and set it up (even maybe how to get hold of PES 2021) all via our discord channel All links are in the next post

PES '99

406,930 次观看 • 7 个月前