🚨CVE-2025-3776: Full WordPress Takeover Without Login (Critical RCE Exploit) Credit:

This is a vulnerability in the TargetSMS plugin, not WP Core.

INTRODUCING: Agentic Security - LLM Security Scanner! 🔍 🔑 Features: Scans for prompt injections, jailbreaking & more. Provides detailed reports & options to customize attack rules. 🔗access the GitHub Link ↓

The Verification SMS with Targetsms plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the targetvr_ajax_handler function. This is due to a lack of validation on the type of function that can be called. This makes it possible for unauthenticated attackers to execute any callable function on the site, such as phpinfo().

How to find vulnerable plugin instances in shodan, any dorks ?