This is a republication. The original and always up to date version lives...
This is a republication. The original and always up to date version lives here:
https://own2pwn.fr/articles/appsec/wp2shell-wordpress-rce (it also embeds a live,
non-intrusive exposure checker).
One request. A POST to /wp-json/batch/v1, a slightly twisted JSON body, and the server
answers a perfectly ordinary 200 OK. Thirty seconds later there is one more
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
WordPress Core "wp2shell" RCE flaws get public exploits, patch now
WP2Shell WordPress Vulnerabilities Exploited in the Wild
„wp2shell“: Kritische WordPress-Lücke erlaubt Codeeinschleusung über API
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
Hackers are exploiting recently patched WordPress bugs, putting millions of websites at risk | TechCrunch
WordPress 6.9.5 and 7.0.2 patch wp2shell, a pre-auth core RCE that lets anonymous attackers run code on default installs, even…
Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core,…
In-the-wild exploitation seen for the new WP2Shell WordPress vulnerabilities, officially tracked as CVE-2026-60137 and…
An open WP-SHELLSTORM server exposed tools, logs, and target lists naming 1.4 million sites, with researchers validating 25,195…
Durch Verkettung einer SQL-Injection- und einer API-Lücke können Angreifer Code einschleusen. WordPress hat ein Update…
CVE-2026-8732 in WP Maps Pro lets unauthenticated attackers create admin accounts on 15,000+ WordPress sites. Wordfence blocked…
