Загрузка видео...

Не удалось загрузить видео

Возникла проблема при загрузке этого видео. Это может быть связано с временными проблемами сети или видео может быть недоступно.

На главную

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand... show more

pwn.ai

14,744 subscribers

122,035 просмотров • 1 месяц назад •via X (Twitter)

Наука и технологии

Anya Rossi• Live Now

Private livecam show

Комментарии: 14

Фото профиля H4x0r.DZ

H4x0r.DZ1 месяц назад

👏👏

Фото профиля Daily Bug Bounty Reports

Daily Bug Bounty Reports1 месяц назад

Incredible stuff, unauthenticated RCE on wordpress is massive, thanks for sharing the breakdown with the community

Фото профиля Ray Sabee 🇳🇱

Ray Sabee 🇳🇱1 месяц назад

Damn... only 300. Great find and chaining!!

Фото профиля 0xpi

0xpi1 месяц назад

⚡️⚡️

Фото профиля Potion

Potion1 месяц назад

Do we get a poc?

Фото профиля pwn.ai

pwn.ai1 месяц назад

Yes it's in the blog.

Фото профиля Potion

Potion1 месяц назад

mb bruh was in a rush this morning haha

Фото профиля zadiiii o(≧∀≦)o

zadiiii o(≧∀≦)o1 месяц назад

🙌🙌

Фото профиля TheCzar

TheCzar1 месяц назад

was the 300$ bounty a typo ? well if its not thats crazy

Фото профиля Iván Pérez

Iván Pérez1 месяц назад

Wow👏

Фото профиля Prince of Starkness

Prince of Starkness1 месяц назад

GAD I am getting sick of updating WP. i am starting to replace them with something that is not swiss cheese.

Фото профиля Pumpkin Security

Pumpkin Security1 месяц назад

One-click preauth RCE via a preview link is nasty. Fix shipped, but the interesting part for hunts is how many sites still expose that preview path. you seeing more Click2Shell hits on managed WP hosts or self-hosted installs?

Фото профиля Bali as a Colony of Jakarta

Bali as a Colony of Jakarta1 месяц назад

not critical need admin to click the link

Фото профиля セキュリティー対策委員会

セキュリティー対策委員会1 месяц назад

oh… please let me know the CVE ID.

Похожие видео

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. Please patch CVE-2026-64638 as soon as possible!

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. Please patch CVE-2026-64638 as soon as possible!

pwn.ai

1,661,890 просмотров • 3 месяцев назад

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

Matt Johansen

10,021 просмотров • 3 месяцев назад

Here's showcasing the new zoom out feature coming in WordPress 6.7 🔥 Watch WordPress 6.7 live stream highlights! Link in 🧵 below.

Here's showcasing the new zoom out feature coming in WordPress 6.7 🔥 Watch WordPress 6.7 live stream highlights! Link in 🧵 below.

WordPress

12,250 просмотров • 2 лет назад

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote

BugBunny.ai - Your AI cybersecurity hire.

17,046 просмотров • 3 месяцев назад

Revoluntionize Your Website With Web3-Powered WordPress 🔥 #Web3 #WordPress

Revoluntionize Your Website With Web3-Powered WordPress 🔥 #Web3 #WordPress

Flux I Decentralized Cloud

197,255 просмотров • 3 лет назад

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

Calif

64,737 просмотров • 3 месяцев назад

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956). #Clearnet #DarkWebInformer #DarkWeb #Exploit #Cyberattack #Cybercrime #Wordpress #Infosec #CTI #CVE202427956 #Vulnerability

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956). #Clearnet #DarkWebInformer #DarkWeb #Exploit #Cyberattack #Cybercrime #Wordpress #Infosec #CTI #CVE202427956 #Vulnerability

Dark Web Informer

51,871 просмотров • 2 лет назад

WordPress celebrates 20 years tomorrow. It's grown from a comment on a blog post to a web spanning phenomenon. Thanks to an outstanding community and the freedoms of Open Source. Happy Birthday, WordPress! #WP20 #WordPress

WordPress celebrates 20 years tomorrow. It's grown from a comment on a blog post to a web spanning phenomenon. Thanks to an outstanding community and the freedoms of Open Source. Happy Birthday, WordPress! #WP20 #WordPress

Mike Little

57,371 просмотров • 3 лет назад

🚨CVE-2025-3776: Full WordPress Takeover Without Login (Critical RCE Exploit) Credit:

🚨CVE-2025-3776: Full WordPress Takeover Without Login (Critical RCE Exploit) Credit:

Dark Web Informer

80,833 просмотров • 1 год назад

Managing your entire website gets easier and more enjoyable with every #WordPress release. Take a look at what's coming in 2024. #StateOfTheWord

Managing your entire website gets easier and more enjoyable with every #WordPress release. Take a look at what's coming in 2024. #StateOfTheWord

WordPress

235,324 просмотров • 2 лет назад

It's impressive how modern WordPress can look if you remove the Admin Menu and Top Bar. Inspired by the new shadcn sidebar release, I decided to extend #WordPress to use that new sidebar solution as opposed to the current one. This is WordPress core, just without the old Admin Menu and Top Bar, and the background set to be white, not the current grey. Feels like a brand new platform!

James LePage

29,506 просмотров • 2 лет назад

From #WCEUKeynote: The next major release for WordPress 6.3 will soon be here. Check out the video to see what is in store for this upcoming release. #Wordpress #WCEUKeynote #WCEU

From #WCEUKeynote: The next major release for WordPress 6.3 will soon be here. Check out the video to see what is in store for this upcoming release. #Wordpress #WCEUKeynote #WCEU

WordPress

12,169 просмотров • 3 лет назад

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:

Dark Web Informer

119,436 просмотров • 16 дней назад

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

Hacktron AI

40,093 просмотров • 3 месяцев назад

Building an e-commerce WordPress site with only my voice and #AI. This is an awesome demo and has me excited for what we are working on Automattic and for the entire WordPress ecosystem.

Building an e-commerce WordPress site with only my voice and #AI. This is an awesome demo and has me excited for what we are working on Automattic and for the entire WordPress ecosystem.

James LePage

15,730 просмотров • 1 год назад

🎉 We are thrilled to announce that our decentralized #WordPress solution is out of BETA and into full release! Experience the fusion of WordPress CMS with our cutting-edge Web3 tech for top-notch website performance and security! 🚀 Learn more at

🎉 We are thrilled to announce that our decentralized #WordPress solution is out of BETA and into full release! Experience the fusion of WordPress CMS with our cutting-edge Web3 tech for top-notch website performance and security! 🚀 Learn more at

Flux I Decentralized Cloud

99,908 просмотров • 2 лет назад

If you’ve been wanting to learn WordPress the right way, this is your chance. The WordPress for Starters Bootcamp is an 8-week live training designed to help you build modern, professional WordPress websites from scratch. Here’s what you’ll learn: • WordPress fundamentals • Elementor • Figma to WordPress • Responsive design • Animations • WooCommerce • SEO & performance optimization • Website security • And much more You’ll also build 5–7 real projects, get lifetime access to class recordings, receive downloadable templates and resources, and get direct feedback throughout the bootcamp. Starts: Ongoing Fee: ₦150,000 Register: If you’ve been waiting for the right time to level up your WordPress skills, this is it. Tag someone who needs to see this.

If you’ve been wanting to learn WordPress the right way, this is your chance. The WordPress for Starters Bootcamp is an 8-week live training designed to help you build modern, professional WordPress websites from scratch. Here’s what you’ll learn: • WordPress fundamentals • Elementor • Figma to WordPress • Responsive design • Animations • WooCommerce • SEO & performance optimization • Website security • And much more You’ll also build 5–7 real projects, get lifetime access to class recordings, receive downloadable templates and resources, and get direct feedback throughout the bootcamp. Starts: Ongoing Fee: ₦150,000 Register: If you’ve been waiting for the right time to level up your WordPress skills, this is it. Tag someone who needs to see this.

Daniel • WordPress Engineer

94,420 просмотров • 3 месяцев назад

Back in 2003, I was so excited to install the first version of WordPress. I was hooked. Today, I’m even more excited to release php-node, the Platformatic native module that allows you to run php.net in Node.js . Including WordPress. You're reading this right.

Back in 2003, I was so excited to install the first version of WordPress. I was hooked. Today, I’m even more excited to release php-node, the Platformatic native module that allows you to run php.net in Node.js . Including WordPress. You're reading this right.

Matteo Collina

60,034 просмотров • 1 год назад

Nerve ( ) and the code_auditor example tasklet ( ) using GPT-4o to find a RCE vulnerability in the widget-options v4.0.7 Wordpress Plugin 🧠 Zero code, fully autonomous agent as a simple YAML file.

Nerve ( ) and the code_auditor example tasklet ( ) using GPT-4o to find a RCE vulnerability in the widget-options v4.0.7 Wordpress Plugin 🧠 Zero code, fully autonomous agent as a simple YAML file.

Simone Margaritelli

33,452 просмотров • 1 год назад

6. Wordpress Jetpack AI Now, blogging is easier than ever. You can use the Jetpack AI assistant to help you: · Draft · Create tables · Fix spelling & grammar · Change the tone of your text It's a huge upgrade for Wordpress bloggers.

6. Wordpress Jetpack AI Now, blogging is easier than ever. You can use the Jetpack AI assistant to help you: · Draft · Create tables · Fix spelling & grammar · Change the tone of your text It's a huge upgrade for Wordpress bloggers.

Aakash Gupta

29,042 просмотров • 3 лет назад