正在加载视频...

视频加载失败

返回首页

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand...

pwn_ai's profile picture

pwn.ai

14,744 subscribers

122,035 次观看 • 1 个月前 •via X (Twitter)

科学技术
LIVE

Anya Rossi• Live Now

Private livecam show

14 条评论

H4x0r.DZ 的头像
H4x0r.DZ1 个月前

👏👏

Daily Bug Bounty Reports 的头像
Daily Bug Bounty Reports1 个月前

Incredible stuff, unauthenticated RCE on wordpress is massive, thanks for sharing the breakdown with the community

Ray Sabee 🇳🇱 的头像
Ray Sabee 🇳🇱1 个月前

Damn... only 300. Great find and chaining!!

0xpi 的头像
0xpi1 个月前

⚡️⚡️

Potion 的头像
Potion1 个月前

Do we get a poc?

pwn.ai 的头像
pwn.ai1 个月前

Yes it's in the blog.

Potion 的头像
Potion1 个月前

mb bruh was in a rush this morning haha

zadiiii o(≧∀≦)o 的头像
zadiiii o(≧∀≦)o1 个月前

🙌🙌

TheCzar 的头像
TheCzar1 个月前

was the 300$ bounty a typo ? well if its not thats crazy

Iván Pérez 的头像
Iván Pérez1 个月前

Wow👏

Prince of Starkness 的头像
Prince of Starkness1 个月前

GAD I am getting sick of updating WP. i am starting to replace them with something that is not swiss cheese.

Pumpkin Security 的头像
Pumpkin Security1 个月前

One-click preauth RCE via a preview link is nasty. Fix shipped, but the interesting part for hunts is how many sites still expose that preview path. you seeing more Click2Shell hits on managed WP hosts or self-hosted installs?

Bali as a Colony of Jakarta 的头像
Bali as a Colony of Jakarta1 个月前

not critical need admin to click the link

セキュリティー対策委員会 的头像
セキュリティー対策委員会1 个月前

oh… please let me know the CVE ID.

相关视频

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. Please patch CVE-2026-64638 as soon as possible!
0:32

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. Please patch CVE-2026-64638 as soon as possible!

pwn.ai

1,661,890 次观看 • 3 个月前

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.
1:09

Buckle up! Default Wordpress install vulnerable to unauth’d RCE. Mass exploitation imminent. Patch now.

Matt Johansen

10,021 次观看 • 3 个月前

Here's showcasing the new zoom out feature coming in WordPress 6.7 🔥 Watch WordPress 6.7 live stream highlights! Link in 🧵 below.
1:26

Here's showcasing the new zoom out feature coming in WordPress 6.7 🔥 Watch WordPress 6.7 live stream highlights! Link in 🧵 below.

WordPress

12,250 次观看 • 2 年前

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote
0:38

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote

BugBunny.ai - Your AI cybersecurity hire.

17,046 次观看 • 3 个月前

Revoluntionize Your Website With Web3-Powered WordPress 🔥 #Web3 #WordPress
0:22

Revoluntionize Your Website With Web3-Powered WordPress 🔥 #Web3 #WordPress

Flux I Decentralized Cloud

197,255 次观看 • 3 年前

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!
0:44

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

Calif

64,737 次观看 • 3 个月前

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956). #Clearnet #DarkWebInformer #DarkWeb #Exploit #Cyberattack #Cybercrime #Wordpress #Infosec #CTI #CVE202427956 #Vulnerability
1:06

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956). #Clearnet #DarkWebInformer #DarkWeb #Exploit #Cyberattack #Cybercrime #Wordpress #Infosec #CTI #CVE202427956 #Vulnerability

Dark Web Informer

51,871 次观看 • 2 年前

WordPress celebrates 20 years tomorrow. It's grown from a comment on a blog post to a web spanning phenomenon. Thanks to an outstanding community and the freedoms of Open Source. Happy Birthday, WordPress! #WP20 #WordPress
1:48

WordPress celebrates 20 years tomorrow. It's grown from a comment on a blog post to a web spanning phenomenon. Thanks to an outstanding community and the freedoms of Open Source. Happy Birthday, WordPress! #WP20 #WordPress

Mike Little

57,371 次观看 • 3 年前

🚨CVE-2025-3776: Full WordPress Takeover Without Login (Critical RCE Exploit) Credit:
6:14

🚨CVE-2025-3776: Full WordPress Takeover Without Login (Critical RCE Exploit) Credit:

Dark Web Informer

80,833 次观看 • 1 年前

Managing your entire website gets easier and more enjoyable with every #WordPress release. Take a look at what's coming in 2024. #StateOfTheWord
0:22

Managing your entire website gets easier and more enjoyable with every #WordPress release. Take a look at what's coming in 2024. #StateOfTheWord

WordPress

235,324 次观看 • 2 年前

It's impressive how modern WordPress can look if you remove the Admin Menu and Top Bar. Inspired by the new shadcn sidebar release, I decided to extend #WordPress to use that new sidebar solution as opposed to the current one. This is WordPress core, just without the old Admin Menu and Top Bar, and the background set to be white, not the current grey. Feels like a brand new platform!
1:07

It's impressive how modern WordPress can look if you remove the Admin Menu and Top Bar. Inspired by the new shadcn sidebar release, I decided to extend #WordPress to use that new sidebar solution as opposed to the current one. This is WordPress core, just without the old Admin Menu and Top Bar, and the background set to be white, not the current grey. Feels like a brand new platform!

James LePage

29,506 次观看 • 2 年前

From #WCEUKeynote: The next major release for WordPress 6.3 will soon be here. Check out the video to see what is in store for this upcoming release. #Wordpress #WCEUKeynote #WCEU
3:22

From #WCEUKeynote: The next major release for WordPress 6.3 will soon be here. Check out the video to see what is in store for this upcoming release. #Wordpress #WCEUKeynote #WCEU

WordPress

12,169 次观看 • 3 年前

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:
0:28

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:

Dark Web Informer

119,436 次观看 • 16 天前

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find
0:41

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

Hacktron AI

40,093 次观看 • 3 个月前

Building an e-commerce WordPress site with only my voice and #AI. This is an awesome demo and has me excited for what we are working on Automattic and for the entire WordPress ecosystem.
7:45

Building an e-commerce WordPress site with only my voice and #AI. This is an awesome demo and has me excited for what we are working on Automattic and for the entire WordPress ecosystem.

James LePage

15,730 次观看 • 1 年前

🎉 We are thrilled to announce that our decentralized #WordPress solution is out of BETA and into full release! Experience the fusion of WordPress CMS with our cutting-edge Web3 tech for top-notch website performance and security! 🚀 Learn more at
0:37

🎉 We are thrilled to announce that our decentralized #WordPress solution is out of BETA and into full release! Experience the fusion of WordPress CMS with our cutting-edge Web3 tech for top-notch website performance and security! 🚀 Learn more at

Flux I Decentralized Cloud

99,908 次观看 • 2 年前

If you’ve been wanting to learn WordPress the right way, this is your chance. The WordPress for Starters Bootcamp is an 8-week live training designed to help you build modern, professional WordPress websites from scratch. Here’s what you’ll learn: • WordPress fundamentals • Elementor • Figma to WordPress • Responsive design • Animations • WooCommerce • SEO & performance optimization • Website security • And much more You’ll also build 5–7 real projects, get lifetime access to class recordings, receive downloadable templates and resources, and get direct feedback throughout the bootcamp. Starts: Ongoing Fee: ₦150,000 Register: If you’ve been waiting for the right time to level up your WordPress skills, this is it. Tag someone who needs to see this.
0:52

If you’ve been wanting to learn WordPress the right way, this is your chance. The WordPress for Starters Bootcamp is an 8-week live training designed to help you build modern, professional WordPress websites from scratch. Here’s what you’ll learn: • WordPress fundamentals • Elementor • Figma to WordPress • Responsive design • Animations • WooCommerce • SEO & performance optimization • Website security • And much more You’ll also build 5–7 real projects, get lifetime access to class recordings, receive downloadable templates and resources, and get direct feedback throughout the bootcamp. Starts: Ongoing Fee: ₦150,000 Register: If you’ve been waiting for the right time to level up your WordPress skills, this is it. Tag someone who needs to see this.

Daniel • WordPress Engineer

94,420 次观看 • 3 个月前

Back in 2003, I was so excited to install the first version of WordPress. I was hooked. Today, I’m even more excited to release php-node, the Platformatic native module that allows you to run php.net in Node.js . Including WordPress. You're reading this right.
2:53

Back in 2003, I was so excited to install the first version of WordPress. I was hooked. Today, I’m even more excited to release php-node, the Platformatic native module that allows you to run php.net in Node.js . Including WordPress. You're reading this right.

Matteo Collina

60,034 次观看 • 1 年前

Nerve ( ) and the code_auditor example tasklet ( ) using GPT-4o to find a RCE vulnerability in the widget-options v4.0.7 Wordpress Plugin 🧠 Zero code, fully autonomous agent as a simple YAML file.
0:46

Nerve ( ) and the code_auditor example tasklet ( ) using GPT-4o to find a RCE vulnerability in the widget-options v4.0.7 Wordpress Plugin 🧠 Zero code, fully autonomous agent as a simple YAML file.

Simone Margaritelli

33,452 次观看 • 1 年前

6. Wordpress Jetpack AI Now, blogging is easier than ever. You can use the Jetpack AI assistant to help you: · Draft · Create tables · Fix spelling & grammar · Change the tone of your text It's a huge upgrade for Wordpress bloggers.
0:48

6. Wordpress Jetpack AI Now, blogging is easier than ever. You can use the Jetpack AI assistant to help you: · Draft · Create tables · Fix spelling & grammar · Change the tone of your text It's a huge upgrade for Wordpress bloggers.

Aakash Gupta

29,042 次观看 • 3 年前