Loading video...

Video Failed to Load

Go Home

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand...

108,578 views • 5 days ago •via X (Twitter)

14 Comments

H4x0r.DZ's profile picture
H4x0r.DZ5 days ago

👏👏

Daily Bug Bounty Reports's profile picture
Daily Bug Bounty Reports5 days ago

Incredible stuff, unauthenticated RCE on wordpress is massive, thanks for sharing the breakdown with the community

Ray Sabee 🇳🇱's profile picture
Ray Sabee 🇳🇱5 days ago

Damn... only 300. Great find and chaining!!

0xpi's profile picture
0xpi5 days ago

⚡️⚡️

Potion's profile picture
Potion5 days ago

Do we get a poc?

pwn.ai's profile picture
pwn.ai5 days ago

Yes it's in the blog.

Potion's profile picture
Potion5 days ago

mb bruh was in a rush this morning haha

zadiiii o(≧∀≦)o's profile picture
zadiiii o(≧∀≦)o5 days ago

🙌🙌

TheCzar's profile picture
TheCzar4 days ago

was the 300$ bounty a typo ? well if its not thats crazy

Iván Pérez's profile picture
Iván Pérez5 days ago

Wow👏

Prince of Starkness's profile picture
Prince of Starkness4 days ago

GAD I am getting sick of updating WP. i am starting to replace them with something that is not swiss cheese.

Pumpkin Security's profile picture
Pumpkin Security5 days ago

One-click preauth RCE via a preview link is nasty. Fix shipped, but the interesting part for hunts is how many sites still expose that preview path. you seeing more Click2Shell hits on managed WP hosts or self-hosted installs?

Bali as a Colony of Jakarta's profile picture
Bali as a Colony of Jakarta5 days ago

not critical need admin to click the link

セキュリティー対策委員会's profile picture
セキュリティー対策委員会5 days ago

oh… please let me know the CVE ID.

Related Videos

Tonkeeper is now Keeper The best self-custodial wallet on TON now holds assets on $BTC, Ethereum, TRON DAO, Arbitrum, Base, BNB Chain — with more chains landing soon. 77 million downloads and counting. One wallet for everything you own. Tonkeeper was built for one chain and set the standard on it. Crypto stopped being one chain per wallet, and so did we. Keeper brings that standard to every chain we support and the communities that call them home. ● TON is home Jettons, NFTs, staking, DNS, the in-wallet browser. Everything that made Tonkeeper the default on TON is here, untouched. TON is not going anywhere. Neither are we. We are taking it further. $BTC $ETH $USDT $TRX $ARB $BNB and more. One app. ● What multichain gives you One app and one recovery phrase for every account on every network — including every chain we add from here. Why do you need a new wallet instead of just adding networks to the old one? TON uses its own key generation scheme, which isn't compatible with the BIP-39/44 standard that EVM networks and most other wallets run on. That's why a single seed phrase technically can't cover both TON and the other networks. You need a separate wallet with a separate phrase. ● Swaps across chains happen inside the wallet: no bridges, no wrapped tokens, no second app to install. Pick what you have, pick what you want, confirm. Built with our partner MoonPay 🟣 . ● Gas is handled. Battery covers the network fee on TON and TRON, so you never buy a second token just to move the first one. Your USDT on TRON moves with zero TRX in the wallet. Multichain is live in the iOS and Android apps today. Web, desktop and the browser extension get it shortly after. 💙To everyone who has been with us since Tonkeeper Thank you. You've been a huge part of our growth and we want to give something back. 0% fees on cross-chain swaps until September 22, on us. And if you migrate your funds right now, you'll also get tickets toward the mystery raffle. In a week, you'll find out exactly why it was worth hurrying. This is just the beginning More networks. Battery on more chains. The wallet you trusted with one chain is about to run all of them. Be a Keeper Get Keeper:

Keeper (prev. Tonkeeper)

1,695,573 views • 8 days ago