Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand... show more

pwn.ai

14,744 subscribers

122,035 views • 1 month ago •via X (Twitter)

Science & Technology

Anya Rossi• Live Now

Private livecam show

14 Comments

H4x0r.DZ1 month ago

👏👏

Daily Bug Bounty Reports1 month ago

Incredible stuff, unauthenticated RCE on wordpress is massive, thanks for sharing the breakdown with the community

Ray Sabee 🇳🇱1 month ago

Damn... only 300. Great find and chaining!!

0xpi1 month ago

⚡️⚡️

Potion1 month ago

Do we get a poc?

pwn.ai1 month ago

Yes it's in the blog.

Potion1 month ago

mb bruh was in a rush this morning haha

zadiiii o(≧∀≦)o1 month ago

🙌🙌

TheCzar1 month ago

was the 300$ bounty a typo ? well if its not thats crazy

Iván Pérez1 month ago

Wow👏

Prince of Starkness1 month ago

GAD I am getting sick of updating WP. i am starting to replace them with something that is not swiss cheese.

Pumpkin Security1 month ago

One-click preauth RCE via a preview link is nasty. Fix shipped, but the interesting part for hunts is how many sites still expose that preview path. you seeing more Click2Shell hits on managed WP hosts or self-hosted installs?

Bali as a Colony of Jakarta1 month ago

not critical need admin to click the link

セキュリティー対策委員会1 month ago

oh… please let me know the CVE ID.

Related Videos

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. Please patch CVE-2026-64638 as soon as possible!

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. Please patch CVE-2026-64638 as soon as possible!

pwn.ai

1,661,890 views • 3 months ago

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

Matt Johansen

10,021 views • 3 months ago

Here's showcasing the new zoom out feature coming in WordPress 6.7 🔥 Watch WordPress 6.7 live stream highlights! Link in 🧵 below.

Here's showcasing the new zoom out feature coming in WordPress 6.7 🔥 Watch WordPress 6.7 live stream highlights! Link in 🧵 below.

WordPress

12,250 views • 2 years ago

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote

BugBunny.ai - Your AI cybersecurity hire.

17,046 views • 3 months ago

Revoluntionize Your Website With Web3-Powered WordPress 🔥 #Web3 #WordPress

Revoluntionize Your Website With Web3-Powered WordPress 🔥 #Web3 #WordPress

Flux I Decentralized Cloud

197,255 views • 3 years ago

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

Calif

64,737 views • 3 months ago

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956). #Clearnet #DarkWebInformer #DarkWeb #Exploit #Cyberattack #Cybercrime #Wordpress #Infosec #CTI #CVE202427956 #Vulnerability

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956). #Clearnet #DarkWebInformer #DarkWeb #Exploit #Cyberattack #Cybercrime #Wordpress #Infosec #CTI #CVE202427956 #Vulnerability

Dark Web Informer

51,871 views • 2 years ago

WordPress celebrates 20 years tomorrow. It's grown from a comment on a blog post to a web spanning phenomenon. Thanks to an outstanding community and the freedoms of Open Source. Happy Birthday, WordPress! #WP20 #WordPress

WordPress celebrates 20 years tomorrow. It's grown from a comment on a blog post to a web spanning phenomenon. Thanks to an outstanding community and the freedoms of Open Source. Happy Birthday, WordPress! #WP20 #WordPress

Mike Little

57,371 views • 3 years ago

🚨CVE-2025-3776: Full WordPress Takeover Without Login (Critical RCE Exploit) Credit:

🚨CVE-2025-3776: Full WordPress Takeover Without Login (Critical RCE Exploit) Credit:

Dark Web Informer

80,833 views • 1 year ago

Managing your entire website gets easier and more enjoyable with every #WordPress release. Take a look at what's coming in 2024. #StateOfTheWord

Managing your entire website gets easier and more enjoyable with every #WordPress release. Take a look at what's coming in 2024. #StateOfTheWord

WordPress

235,324 views • 2 years ago

It's impressive how modern WordPress can look if you remove the Admin Menu and Top Bar. Inspired by the new shadcn sidebar release, I decided to extend #WordPress to use that new sidebar solution as opposed to the current one. This is WordPress core, just without the old Admin Menu and Top Bar, and the background set to be white, not the current grey. Feels like a brand new platform!

James LePage

29,506 views • 2 years ago

From #WCEUKeynote: The next major release for WordPress 6.3 will soon be here. Check out the video to see what is in store for this upcoming release. #Wordpress #WCEUKeynote #WCEU

From #WCEUKeynote: The next major release for WordPress 6.3 will soon be here. Check out the video to see what is in store for this upcoming release. #Wordpress #WCEUKeynote #WCEU

WordPress

12,169 views • 3 years ago

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:

Dark Web Informer

119,436 views • 16 days ago

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

Hacktron AI

40,093 views • 3 months ago

Building an e-commerce WordPress site with only my voice and #AI. This is an awesome demo and has me excited for what we are working on Automattic and for the entire WordPress ecosystem.

Building an e-commerce WordPress site with only my voice and #AI. This is an awesome demo and has me excited for what we are working on Automattic and for the entire WordPress ecosystem.

James LePage

15,730 views • 1 year ago

🎉 We are thrilled to announce that our decentralized #WordPress solution is out of BETA and into full release! Experience the fusion of WordPress CMS with our cutting-edge Web3 tech for top-notch website performance and security! 🚀 Learn more at

🎉 We are thrilled to announce that our decentralized #WordPress solution is out of BETA and into full release! Experience the fusion of WordPress CMS with our cutting-edge Web3 tech for top-notch website performance and security! 🚀 Learn more at

Flux I Decentralized Cloud

99,908 views • 2 years ago

If you’ve been wanting to learn WordPress the right way, this is your chance. The WordPress for Starters Bootcamp is an 8-week live training designed to help you build modern, professional WordPress websites from scratch. Here’s what you’ll learn: • WordPress fundamentals • Elementor • Figma to WordPress • Responsive design • Animations • WooCommerce • SEO & performance optimization • Website security • And much more You’ll also build 5–7 real projects, get lifetime access to class recordings, receive downloadable templates and resources, and get direct feedback throughout the bootcamp. Starts: Ongoing Fee: ₦150,000 Register: If you’ve been waiting for the right time to level up your WordPress skills, this is it. Tag someone who needs to see this.

If you’ve been wanting to learn WordPress the right way, this is your chance. The WordPress for Starters Bootcamp is an 8-week live training designed to help you build modern, professional WordPress websites from scratch. Here’s what you’ll learn: • WordPress fundamentals • Elementor • Figma to WordPress • Responsive design • Animations • WooCommerce • SEO & performance optimization • Website security • And much more You’ll also build 5–7 real projects, get lifetime access to class recordings, receive downloadable templates and resources, and get direct feedback throughout the bootcamp. Starts: Ongoing Fee: ₦150,000 Register: If you’ve been waiting for the right time to level up your WordPress skills, this is it. Tag someone who needs to see this.

Daniel • WordPress Engineer

94,420 views • 3 months ago

Back in 2003, I was so excited to install the first version of WordPress. I was hooked. Today, I’m even more excited to release php-node, the Platformatic native module that allows you to run php.net in Node.js . Including WordPress. You're reading this right.

Back in 2003, I was so excited to install the first version of WordPress. I was hooked. Today, I’m even more excited to release php-node, the Platformatic native module that allows you to run php.net in Node.js . Including WordPress. You're reading this right.

Matteo Collina

60,034 views • 1 year ago

Nerve ( ) and the code_auditor example tasklet ( ) using GPT-4o to find a RCE vulnerability in the widget-options v4.0.7 Wordpress Plugin 🧠 Zero code, fully autonomous agent as a simple YAML file.

Nerve ( ) and the code_auditor example tasklet ( ) using GPT-4o to find a RCE vulnerability in the widget-options v4.0.7 Wordpress Plugin 🧠 Zero code, fully autonomous agent as a simple YAML file.

Simone Margaritelli

33,452 views • 1 year ago

6. Wordpress Jetpack AI Now, blogging is easier than ever. You can use the Jetpack AI assistant to help you: · Draft · Create tables · Fix spelling & grammar · Change the tone of your text It's a huge upgrade for Wordpress bloggers.

6. Wordpress Jetpack AI Now, blogging is easier than ever. You can use the Jetpack AI assistant to help you: · Draft · Create tables · Fix spelling & grammar · Change the tone of your text It's a huge upgrade for Wordpress bloggers.

Aakash Gupta

29,042 views • 3 years ago