Skip to main content

mastodon - Link to source

Holy shit

wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain

" Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory."

github.com/Icex0/wp2shell-poc

#WordPress #RCE


GitHub - Icex0/wp2shell-poc: wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain

wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain - Icex0/wp2shell-poc
GitHub
#Wordpress #rce
in reply to stux⚡️

Milo
glitchsoc - Link to source
Milo
• •
using WordPress is simply a security risk...
in reply to Milo

Ray McCarthy
mastodon - Link to source
Ray McCarthy
• •
@milo
Using the Internet is a security risk. Server or client.
@Milo
in reply to Ray McCarthy

Milo
glitchsoc - Link to source
Milo
• •
@raymaccarthy Given how often critical security vulnerabilities are reported in WordPress core and plugins, this simply poses too great a security risk compared to other CMSs
@Ray McCarthy
in reply to Milo

stux⚡️
mastodon - Link to source
stux⚡️
• •
@milo @raymaccarthy WordPress is a little over the top the last few years.. I mostly use Ghost now but rather just Laravel and build it myself, no unneeded bloated code that can be a security risk
@Ray McCarthy @Milo
in reply to stux⚡️

Ray McCarthy
mastodon - Link to source
Ray McCarthy
• •

@milo
People need to not madly add plugins, which increase the vulnerability, assuming not actually malware.

Some other CMS are dreadful to update. Especial Drupal or Mediawiki. So people don't update!

Adobe Commerce used to be Magneto and was terrible for vulnerabilities?

Wordpress suffers from the exposure of being the most popular? Your own install with custom .htaccess and file permissions (especially on upload directories).

@Milo
in reply to stux⚡️

Lauren Weinstein
mastodon - Link to source
Lauren Weinstein
• •
I discussed this a number of days ago. A site to test vulnerability, and a plugin to block the exploit if you can't or don't want to upgrade wp, is here: wp2shell.com/
in reply to stux⚡️

Laura
mastodon - Link to source
Laura
• •
I thought the whole thing of WordPress was being CVE first, CMS second.
⇧