正在加载视频...

视频加载失败

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand...

108,578 次观看 • 5 天前 •via X (Twitter)

14 条评论

H4x0r.DZ 的头像
H4x0r.DZ5 天前

👏👏

Daily Bug Bounty Reports 的头像
Daily Bug Bounty Reports5 天前

Incredible stuff, unauthenticated RCE on wordpress is massive, thanks for sharing the breakdown with the community

Ray Sabee 🇳🇱 的头像
Ray Sabee 🇳🇱5 天前

Damn... only 300. Great find and chaining!!

0xpi 的头像
0xpi5 天前

⚡️⚡️

Potion 的头像
Potion5 天前

Do we get a poc?

pwn.ai 的头像
pwn.ai5 天前

Yes it's in the blog.

Potion 的头像
Potion5 天前

mb bruh was in a rush this morning haha

zadiiii o(≧∀≦)o 的头像
zadiiii o(≧∀≦)o5 天前

🙌🙌

TheCzar 的头像
TheCzar4 天前

was the 300$ bounty a typo ? well if its not thats crazy

Iván Pérez 的头像
Iván Pérez5 天前

Wow👏

Prince of Starkness 的头像
Prince of Starkness4 天前

GAD I am getting sick of updating WP. i am starting to replace them with something that is not swiss cheese.

Pumpkin Security 的头像
Pumpkin Security5 天前

One-click preauth RCE via a preview link is nasty. Fix shipped, but the interesting part for hunts is how many sites still expose that preview path. you seeing more Click2Shell hits on managed WP hosts or self-hosted installs?

Bali as a Colony of Jakarta 的头像
Bali as a Colony of Jakarta5 天前

not critical need admin to click the link

セキュリティー対策委員会 的头像
セキュリティー対策委員会5 天前

oh… please let me know the CVE ID.

相关视频

Tonkeeper is now Keeper The best self-custodial wallet on TON now holds assets on $BTC, Ethereum, TRON DAO, Arbitrum, Base, BNB Chain — with more chains landing soon. 77 million downloads and counting. One wallet for everything you own. Tonkeeper was built for one chain and set the standard on it. Crypto stopped being one chain per wallet, and so did we. Keeper brings that standard to every chain we support and the communities that call them home. ● TON is home Jettons, NFTs, staking, DNS, the in-wallet browser. Everything that made Tonkeeper the default on TON is here, untouched. TON is not going anywhere. Neither are we. We are taking it further. $BTC $ETH $USDT $TRX $ARB $BNB and more. One app. ● What multichain gives you One app and one recovery phrase for every account on every network — including every chain we add from here. Why do you need a new wallet instead of just adding networks to the old one? TON uses its own key generation scheme, which isn't compatible with the BIP-39/44 standard that EVM networks and most other wallets run on. That's why a single seed phrase technically can't cover both TON and the other networks. You need a separate wallet with a separate phrase. ● Swaps across chains happen inside the wallet: no bridges, no wrapped tokens, no second app to install. Pick what you have, pick what you want, confirm. Built with our partner MoonPay 🟣 . ● Gas is handled. Battery covers the network fee on TON and TRON, so you never buy a second token just to move the first one. Your USDT on TRON moves with zero TRX in the wallet. Multichain is live in the iOS and Android apps today. Web, desktop and the browser extension get it shortly after. 💙To everyone who has been with us since Tonkeeper Thank you. You've been a huge part of our growth and we want to give something back. 0% fees on cross-chain swaps until September 22, on us. And if you migrate your funds right now, you'll also get tickets toward the mystery raffle. In a week, you'll find out exactly why it was worth hurrying. This is just the beginning More networks. Battery on more chains. The wallet you trusted with one chain is about to run all of them. Be a Keeper Get Keeper:

Keeper (prev. Tonkeeper)

1,695,573 次观看 • 8 天前