A critical WordPress exploit chain dubbed WP2Shell lets unauthenticated attackers run arbitrary code on vulnerable websites by combining REST API route confusion with SQL injection. Seqrite researcher Amruta Wagh describes the chain as a WordPress Core security issue disclosed in July 2026 that eliminates the need for attackers to obtain... Weiterlesen: Hackers Exploit Critical WordPress Flaws to Execute Remote Code Witho…
Intelligence View
⚡ tsecurity.de Intelligence
Hackers Exploit Critical WordPress Flaws to Execute Remote Code Without Authentication
A critical WordPress exploit chain dubbed WP2Shell lets unauthenticated attackers run arbitrary code on vulnerable websites by combining REST API route…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
T1190TA0001 · Initial Access
Exploit Public-Facing Application
Mitigation: M1042 Network Segmentation & WAF Rule Enforcement
Quelle: Kontext-Klassifikation des Artikeltextes
Initial Access
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — free The top security news daily · unsubscribe anytime
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
No reader ratings yet
Was this page helpful?
0
Powered by tsecurity.de
tsecurity.de Hub
Related story clusters & sources (vector AI)
38 sources
CVE-2026-64047 | Linux Kernel up to 7.0.10 TLS tls_push_record off-by-one (Nessus ID 369276)
37 more sources
VVulDB Updates2 hours agoCVE-2026-64109 | Linux Kernel up to 6.6.142/6.12.91/6.18.33/7.0.10 Af Unix unix_stream_data_wait len use after free (Nessus ID 369276) VVulDB Updates2 hours agoCVE-2026-64355 | Linux Kernel up to 7.1.3 BPF/XDP dev_map_enqueue_clone/dev_map_redirect_clone out-of-bounds (Nessus ID 369276) VVulDB Updates2 hours agoCVE-2026-64450 | Linux Kernel up to 7.2-rc1 TIPC tipc_bcast_sync_rcv out-of-bounds (Nessus ID 369276) VVulDB Updates2 hours agoCVE-2026-68139 | Linux Kernel up to 6.12.100/6.18.41/7.1.5/7.2-rc4 Mpv Devcom net/mlx5e mlx5_devcom_comp_set_ready null pointer dereference (WID-SEC-2026-2730) VVulDB Updates1 hour agoCVE-2026-64572 | Linux Kernel up to 7.2-rc3 ipv4 net/ipv4/fib_trie.c fib_table_lookup use after free (Nessus ID 369276) VVulDB Updates1 hour agoCVE-2026-68398 | Linux Kernel up to 7.2-rc3 PPPoL2TP pppol2tp_recv chan use after free (Nessus ID 369276)
+31
15 sources
CVE-2026-113795 | py-pdf pypdf up to 6.19.x memory allocation (EUVD-2026-107337)
14 more sources
VVulDB Updates5 hours agoCVE-2026-114257 | oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 File Download download.php readfile id sql injection (EUVD-2026-107336) VVulDB Updates5 hours agoCVE-2026-113794 | py-pdf pypdf up to 6.19.x infinite loop (EUVD-2026-107335) VVulDB Updates5 hours agoCVE-2026-113793 | py-pdf pypdf up to 6.20.0 infinite loop (EUVD-2026-107334) VVulDB Updates5 hours agoCVE-2026-91366 | Oracle Siebel CRM Cloud Applications up to 26.9 Siebel Cloud Manager privileges management (EUVD-2026-106620) VVulDB Updates4 hours agoCVE-2026-112951 | ApostropheCMS up to 4.33.x Color Field color cross site scripting (EUVD-2026-105154) VVulDB Updates4 hours agoCVE-2026-113649 | ApostropheCMS import-export privileges management (EUVD-2026-105184)
+8
7 sources
CVE-2026-111805 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 resource consumption (EUVD-2026-107497)
6 more sources
VVulDB Updates1 hour agoCVE-2026-114136 | encode Django REST Framework up to 3.18.1 JSONParser parsers.py JSONParser.parse resource consumption (EUVD-2026-107546) VVulDB Updates2 hours agoCVE-2026-111809 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 request smuggling (EUVD-2026-107503) VVulDB Updates2 hours agoCVE-2026-111810 | Apache Traffic Server 9.2.15/10.1.4/10.2.0 resource consumption (EUVD-2026-107501) VVulDB Updates2 hours agoCVE-2026-111815 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 certificate validation (EUVD-2026-107500) VVulDB Updates2 hours agoCVE-2026-111814 | Apache Traffic Server up to 9.2.15/10.1.4/10.2.0 Session Sharing Policy certificate validation (EUVD-2026-107499) VVulDB Updates2 hours agoCVE-2026-111808 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 resource consumption (EUVD-2026-107498)
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/en/4280889/cyber-security-bulletins/hackers-exploit-critical-wordpress-flaws-to-execute-remote-code-without-authentication/