WP2Shell combines two WordPress Core flaws to move from an unauthenticated request to server-side code execution. It can let an attacker create an administrator account and install a plugin-based web shell. Seqrite’s October 16 analysis lists affected releases, but does not establish widespread live exploitation. The report says the flaws were... Weiterlesen: WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Inst…
Intelligence View
⚡ tsecurity.de Intelligence
WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Install Web Shells Without Login
WP2Shell combines two WordPress Core flaws to move from an unauthenticated request to server-side code execution. It can let an attacker create an…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
T1505TA0011 · Command and Control
Server Software Component
Mitigation: M1018 User Account Management
Quelle: Kontext-Klassifikation des Artikeltextes
Command and Control
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Powered by tsecurity.de
tsecurity.de Hub
Verwandte Story-Cluster & Quellen (Vektor-KI)
14 Quellen
CVE-2026-16762 | Qt up to 4.2.x/6.8.8/6.11.1 QXmlStreamReader denial of service (EUVD-2026-108655)
13 weitere Quellen
VVulDB Updatesvor 2 Std.CVE-2026-25784 | Hallo Welt! BlueSpice up to 5.2.6 Token Authenticator LocalSettings.php mwsgTokenAuthenticatorServiceCIDR default permission (EUVD-2026-108653) VVulDB Updatesvor 2 Std.CVE-2026-25716 | Hallo Welt! BlueSpice up to 5.1.10/5.2.6 UserManager create unblockUser improper authorization (EUVD-2026-108651) VVulDB Updatesvor 1 Std.CVE-2026-91403 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition JSSE privileges management (EUVD-2026-107578) VVulDB Updatesvor 1 Std.CVE-2026-114406 | Red Hat Satellite 6 ca-certificates certificate validation (EUVD-2026-107565) VVulDB Updatesvor 1 Std.CVE-2026-105963 | elixir-plug plug/plug_crypto Plug.Crypto.verify/Plug.Crypto.secure_compare information disclosure (EUVD-2026-108666) VVulDB Updatesvor 1 Std.CVE-2026-89320 | Eclipse KeyPont HmacShaCryptor.Hash data authenticity (EUVD-2026-108654)
+7
12 Quellen
CVE-2025-30051 | CGM CLININET up to 2026.MS2 Configuration File SysIO.pl permission (EUVD-2025-211181)
11 weitere Quellen
VVulDB Updatesvor 3 Std.CVE-2025-30049 | CGM CLININET up to 2026.MS3 weak password hash (EUVD-2025-211179) VVulDB Updatesvor 3 Std.CVE-2025-30047 | CGM CLININET up to 2026.MS2 deserialization (EUVD-2025-211178) VVulDB Updatesvor 3 Std.CVE-2025-30050 | CGM CLININET up to 2026.MS2 RunCGI RunCGI.pm os command injection (EUVD-2025-211180) VVulDB Updatesvor 3 Std.CVE-2025-30045 | CGM CLININET up to 2026.MS3 ConvExpr code injection (EUVD-2025-211176) VVulDB Updatesvor 3 Std.CVE-2025-30046 | CGM CLININET up to 2026.MS3 HL7 Communication privileges management (EUVD-2025-211177) VVulDB Updatesvor 3 Std.CVE-2025-30043 | CGM CLININET up to 2026.MS2 missing authentication (EUVD-2025-211175)
+5
8 Quellen
How to watch The Northumbria Mysteries for free, online and from anywhere
7 weitere Quellen
LLatest from TechRadarvor 2 Std.How to watch Chaar Yaar online – stream the Hindi crime series from anywhere for free LLatest from TechRadarvor 2 Std.How to watch Kon Yashwant Pansare online from anywhere LLatest from TechRadarvor 2 Std.How to watch Aryabhatt Ka Zero online from anywhere LLatest from TechRadarvor 2 Std.How to watch Kinare Kinare online from anywhere LLatest from TechRadarvor 2 Std.How to watch Maa Inti Bangaaram online from anywhere LLatest from TechRadarvor 1 Std.How to watch Mercury Music Prize for free – stream full replay
+1
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/de/4285043/it-security-nachrichten/wp2shell-attack-lets-hackers-create-wordpress-admin-accounts-and-install-web-shells-without-login/