We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

@hash_kitten Wow! Impress.... Errrr... No. Any jailbroken ai can do this in less than 2 minutes. Meh.

@hash_kitten Being such a proud owner of this impressive collection of hashtags, why are you even here? You'd have a bright future as a thought leader on LinkedIn.

@hash_kitten 💪🏻💪🏻💪🏻💪🏻💪🏻 Still "WoRdPrEsS PoC"

@hash_kitten Omg I was overlooking the issue till I seen this. 😭 got me running back to my website. Thank u for saving my life

@hash_kitten

@hash_kitten admin creation possible on it?

@hash_kitten it looks like it is so much easy to do .... I was initially ignoring it but now I understand what damage it can make

@hash_kitten Hasta los plugins oficiales de WP son malware, cual es el apuro?

@hash_kitten Stacked query to insert a new admin account? 👀👀

@hash_kitten Oh oups. Hopefully no one will make a worm out of that.