Video wird geladen...

Video konnte nicht geladen werden

Beim Laden dieses Videos ist ein Problem aufgetreten. Dies könnte an einem vorübergehenden Netzwerkproblem liegen oder das Video ist möglicherweise nicht verfügbar.

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand... show more

pwn.ai

14,744 subscribers

122,035 Aufrufe • vor 1 Monat •via X (Twitter)

Wissenschaft & Technologie

Anya Rossi• Live Now

Private livecam show

14 Kommentare

Profilbild von H4x0r.DZ

H4x0r.DZvor 1 Monat

👏👏

Profilbild von Daily Bug Bounty Reports

Daily Bug Bounty Reportsvor 1 Monat

Incredible stuff, unauthenticated RCE on wordpress is massive, thanks for sharing the breakdown with the community

Profilbild von Ray Sabee 🇳🇱

Ray Sabee 🇳🇱vor 1 Monat

Damn... only 300. Great find and chaining!!

Profilbild von 0xpi

0xpivor 1 Monat

⚡️⚡️

Profilbild von Potion

Potionvor 1 Monat

Do we get a poc?

Profilbild von pwn.ai

pwn.aivor 1 Monat

Yes it's in the blog.

Profilbild von Potion

Potionvor 1 Monat

mb bruh was in a rush this morning haha

Profilbild von zadiiii o(≧∀≦)o

zadiiii o(≧∀≦)ovor 1 Monat

🙌🙌

Profilbild von TheCzar

TheCzarvor 1 Monat

was the 300$ bounty a typo ? well if its not thats crazy

Profilbild von Iván Pérez

Iván Pérezvor 1 Monat

Wow👏

Profilbild von Prince of Starkness

Prince of Starknessvor 1 Monat

GAD I am getting sick of updating WP. i am starting to replace them with something that is not swiss cheese.

Profilbild von Pumpkin Security

Pumpkin Securityvor 1 Monat

One-click preauth RCE via a preview link is nasty. Fix shipped, but the interesting part for hunts is how many sites still expose that preview path. you seeing more Click2Shell hits on managed WP hosts or self-hosted installs?

Profilbild von Bali as a Colony of Jakarta

Bali as a Colony of Jakartavor 1 Monat

not critical need admin to click the link

Profilbild von セキュリティー対策委員会

セキュリティー対策委員会vor 1 Monat

oh… please let me know the CVE ID.

Ähnliche Videos

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. Please patch CVE-2026-64638 as soon as possible!

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. Please patch CVE-2026-64638 as soon as possible!

pwn.ai

1,661,890 Aufrufe • vor 3 Monaten

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

Matt Johansen

10,021 Aufrufe • vor 3 Monaten

Here's showcasing the new zoom out feature coming in WordPress 6.7 🔥 Watch WordPress 6.7 live stream highlights! Link in 🧵 below.

Here's showcasing the new zoom out feature coming in WordPress 6.7 🔥 Watch WordPress 6.7 live stream highlights! Link in 🧵 below.

WordPress

12,250 Aufrufe • vor 2 Jahren

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote

BugBunny.ai - Your AI cybersecurity hire.

17,046 Aufrufe • vor 3 Monaten

Revoluntionize Your Website With Web3-Powered WordPress 🔥 #Web3 #WordPress

Revoluntionize Your Website With Web3-Powered WordPress 🔥 #Web3 #WordPress

Flux I Decentralized Cloud

197,255 Aufrufe • vor 3 Jahren

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

Calif

64,737 Aufrufe • vor 3 Monaten

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956). #Clearnet #DarkWebInformer #DarkWeb #Exploit #Cyberattack #Cybercrime #Wordpress #Infosec #CTI #CVE202427956 #Vulnerability

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956). #Clearnet #DarkWebInformer #DarkWeb #Exploit #Cyberattack #Cybercrime #Wordpress #Infosec #CTI #CVE202427956 #Vulnerability

Dark Web Informer

51,871 Aufrufe • vor 2 Jahren

WordPress celebrates 20 years tomorrow. It's grown from a comment on a blog post to a web spanning phenomenon. Thanks to an outstanding community and the freedoms of Open Source. Happy Birthday, WordPress! #WP20 #WordPress

WordPress celebrates 20 years tomorrow. It's grown from a comment on a blog post to a web spanning phenomenon. Thanks to an outstanding community and the freedoms of Open Source. Happy Birthday, WordPress! #WP20 #WordPress

Mike Little

57,371 Aufrufe • vor 3 Jahren

🚨CVE-2025-3776: Full WordPress Takeover Without Login (Critical RCE Exploit) Credit:

🚨CVE-2025-3776: Full WordPress Takeover Without Login (Critical RCE Exploit) Credit:

Dark Web Informer

80,833 Aufrufe • vor 1 Jahr

Managing your entire website gets easier and more enjoyable with every #WordPress release. Take a look at what's coming in 2024. #StateOfTheWord

Managing your entire website gets easier and more enjoyable with every #WordPress release. Take a look at what's coming in 2024. #StateOfTheWord

WordPress

235,324 Aufrufe • vor 2 Jahren

It's impressive how modern WordPress can look if you remove the Admin Menu and Top Bar. Inspired by the new shadcn sidebar release, I decided to extend #WordPress to use that new sidebar solution as opposed to the current one. This is WordPress core, just without the old Admin Menu and Top Bar, and the background set to be white, not the current grey. Feels like a brand new platform!

James LePage

29,506 Aufrufe • vor 2 Jahren

From #WCEUKeynote: The next major release for WordPress 6.3 will soon be here. Check out the video to see what is in store for this upcoming release. #Wordpress #WCEUKeynote #WCEU

From #WCEUKeynote: The next major release for WordPress 6.3 will soon be here. Check out the video to see what is in store for this upcoming release. #Wordpress #WCEUKeynote #WCEU

WordPress

12,169 Aufrufe • vor 3 Jahren

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:

Dark Web Informer

119,436 Aufrufe • vor 16 Tagen

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

Hacktron AI

40,093 Aufrufe • vor 3 Monaten

Building an e-commerce WordPress site with only my voice and #AI. This is an awesome demo and has me excited for what we are working on Automattic and for the entire WordPress ecosystem.

Building an e-commerce WordPress site with only my voice and #AI. This is an awesome demo and has me excited for what we are working on Automattic and for the entire WordPress ecosystem.

James LePage

15,730 Aufrufe • vor 1 Jahr

🎉 We are thrilled to announce that our decentralized #WordPress solution is out of BETA and into full release! Experience the fusion of WordPress CMS with our cutting-edge Web3 tech for top-notch website performance and security! 🚀 Learn more at

🎉 We are thrilled to announce that our decentralized #WordPress solution is out of BETA and into full release! Experience the fusion of WordPress CMS with our cutting-edge Web3 tech for top-notch website performance and security! 🚀 Learn more at

Flux I Decentralized Cloud

99,908 Aufrufe • vor 2 Jahren

If you’ve been wanting to learn WordPress the right way, this is your chance. The WordPress for Starters Bootcamp is an 8-week live training designed to help you build modern, professional WordPress websites from scratch. Here’s what you’ll learn: • WordPress fundamentals • Elementor • Figma to WordPress • Responsive design • Animations • WooCommerce • SEO & performance optimization • Website security • And much more You’ll also build 5–7 real projects, get lifetime access to class recordings, receive downloadable templates and resources, and get direct feedback throughout the bootcamp. Starts: Ongoing Fee: ₦150,000 Register: If you’ve been waiting for the right time to level up your WordPress skills, this is it. Tag someone who needs to see this.

If you’ve been wanting to learn WordPress the right way, this is your chance. The WordPress for Starters Bootcamp is an 8-week live training designed to help you build modern, professional WordPress websites from scratch. Here’s what you’ll learn: • WordPress fundamentals • Elementor • Figma to WordPress • Responsive design • Animations • WooCommerce • SEO & performance optimization • Website security • And much more You’ll also build 5–7 real projects, get lifetime access to class recordings, receive downloadable templates and resources, and get direct feedback throughout the bootcamp. Starts: Ongoing Fee: ₦150,000 Register: If you’ve been waiting for the right time to level up your WordPress skills, this is it. Tag someone who needs to see this.

Daniel • WordPress Engineer

94,420 Aufrufe • vor 3 Monaten

Back in 2003, I was so excited to install the first version of WordPress. I was hooked. Today, I’m even more excited to release php-node, the Platformatic native module that allows you to run php.net in Node.js . Including WordPress. You're reading this right.

Back in 2003, I was so excited to install the first version of WordPress. I was hooked. Today, I’m even more excited to release php-node, the Platformatic native module that allows you to run php.net in Node.js . Including WordPress. You're reading this right.

Matteo Collina

60,034 Aufrufe • vor 1 Jahr

Nerve ( ) and the code_auditor example tasklet ( ) using GPT-4o to find a RCE vulnerability in the widget-options v4.0.7 Wordpress Plugin 🧠 Zero code, fully autonomous agent as a simple YAML file.

Nerve ( ) and the code_auditor example tasklet ( ) using GPT-4o to find a RCE vulnerability in the widget-options v4.0.7 Wordpress Plugin 🧠 Zero code, fully autonomous agent as a simple YAML file.

Simone Margaritelli

33,452 Aufrufe • vor 1 Jahr

6. Wordpress Jetpack AI Now, blogging is easier than ever. You can use the Jetpack AI assistant to help you: · Draft · Create tables · Fix spelling & grammar · Change the tone of your text It's a huge upgrade for Wordpress bloggers.

6. Wordpress Jetpack AI Now, blogging is easier than ever. You can use the Jetpack AI assistant to help you: · Draft · Create tables · Fix spelling & grammar · Change the tone of your text It's a huge upgrade for Wordpress bloggers.

Aakash Gupta

29,042 Aufrufe • vor 3 Jahren