Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand...

108,578 Aufrufe • vor 5 Tagen •via X (Twitter)

14 Kommentare

Profilbild von H4x0r.DZ
H4x0r.DZvor 5 Tagen

👏👏

Profilbild von Daily Bug Bounty Reports
Daily Bug Bounty Reportsvor 5 Tagen

Incredible stuff, unauthenticated RCE on wordpress is massive, thanks for sharing the breakdown with the community

Profilbild von Ray Sabee 🇳🇱
Ray Sabee 🇳🇱vor 5 Tagen

Damn... only 300. Great find and chaining!!

Profilbild von 0xpi
0xpivor 5 Tagen

⚡️⚡️

Profilbild von Potion
Potionvor 5 Tagen

Do we get a poc?

Profilbild von pwn.ai
pwn.aivor 5 Tagen

Yes it's in the blog.

Profilbild von Potion
Potionvor 5 Tagen

mb bruh was in a rush this morning haha

Profilbild von zadiiii o(≧∀≦)o
zadiiii o(≧∀≦)ovor 5 Tagen

🙌🙌

Profilbild von TheCzar
TheCzarvor 4 Tagen

was the 300$ bounty a typo ? well if its not thats crazy

Profilbild von Iván Pérez
Iván Pérezvor 5 Tagen

Wow👏

Profilbild von Prince of Starkness
Prince of Starknessvor 4 Tagen

GAD I am getting sick of updating WP. i am starting to replace them with something that is not swiss cheese.

Profilbild von Pumpkin Security
Pumpkin Securityvor 5 Tagen

One-click preauth RCE via a preview link is nasty. Fix shipped, but the interesting part for hunts is how many sites still expose that preview path. you seeing more Click2Shell hits on managed WP hosts or self-hosted installs?

Profilbild von Bali as a Colony of Jakarta
Bali as a Colony of Jakartavor 5 Tagen

not critical need admin to click the link

Profilbild von セキュリティー対策委員会
セキュリティー対策委員会vor 5 Tagen

oh… please let me know the CVE ID.

Ähnliche Videos

Tonkeeper is now Keeper The best self-custodial wallet on TON now holds assets on $BTC, Ethereum, TRON DAO, Arbitrum, Base, BNB Chain — with more chains landing soon. 77 million downloads and counting. One wallet for everything you own. Tonkeeper was built for one chain and set the standard on it. Crypto stopped being one chain per wallet, and so did we. Keeper brings that standard to every chain we support and the communities that call them home. ● TON is home Jettons, NFTs, staking, DNS, the in-wallet browser. Everything that made Tonkeeper the default on TON is here, untouched. TON is not going anywhere. Neither are we. We are taking it further. $BTC $ETH $USDT $TRX $ARB $BNB and more. One app. ● What multichain gives you One app and one recovery phrase for every account on every network — including every chain we add from here. Why do you need a new wallet instead of just adding networks to the old one? TON uses its own key generation scheme, which isn't compatible with the BIP-39/44 standard that EVM networks and most other wallets run on. That's why a single seed phrase technically can't cover both TON and the other networks. You need a separate wallet with a separate phrase. ● Swaps across chains happen inside the wallet: no bridges, no wrapped tokens, no second app to install. Pick what you have, pick what you want, confirm. Built with our partner MoonPay 🟣 . ● Gas is handled. Battery covers the network fee on TON and TRON, so you never buy a second token just to move the first one. Your USDT on TRON moves with zero TRX in the wallet. Multichain is live in the iOS and Android apps today. Web, desktop and the browser extension get it shortly after. 💙To everyone who has been with us since Tonkeeper Thank you. You've been a huge part of our growth and we want to give something back. 0% fees on cross-chain swaps until September 22, on us. And if you migrate your funds right now, you'll also get tickets toward the mystery raffle. In a week, you'll find out exactly why it was worth hurrying. This is just the beginning More networks. Battery on more chains. The wallet you trusted with one chain is about to run all of them. Be a Keeper Get Keeper:

Keeper (prev. Tonkeeper)

1,695,573 Aufrufe • vor 8 Tagen