WP2Shell combines two WordPress Core flaws to move from an unauthenticated request to server-side code execution. It can let an attacker create an administrator account and install a plugin-based web shell. Seqrite’s October 16 analysis lists affected releases, but does not establish widespread live exploitation. The report says the flaws were... Weiterlesen: WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Inst…
Intelligence View
⚡ tsecurity.de Intelligence
WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Install Web Shells Without Login
WP2Shell combines two WordPress Core flaws to move from an unauthenticated request to server-side code execution. It can let an attacker create an…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
T1505TA0011 · Command and Control
Server Software Component
Mitigation: M1018 User Account Management
Quelle: Kontext-Klassifikation des Artikeltextes
Command and Control
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Powered by tsecurity.de
tsecurity.de Hub
Verwandte Story-Cluster & Quellen (Vektor-KI)
14 Quellen
CVE-2026-97559 | Linux Kernel up to 6.18.52/7.2.6/7.3-rc2 SMB Client DACL replace_sids_and_copy_aces/set_chmod_dacl integer overflow (WID-SEC-2026-3579)
13 weitere Quellen
VVulDB Updates6 uur geledenCVE-2026-97561 | Linux Kernel up to 7.2.6/7.3-rc2 SMB Client privileges management (WID-SEC-2026-3579) VVulDB Updates6 uur geledenCVE-2026-97560 | Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc2 SMB Client smb2_parse_native_symlink out-of-bounds (WID-SEC-2026-3579) VVulDB Updates6 uur geledenCVE-2026-97563 | Linux Kernel up to 7.2.6/7.3-rc2 SMB Client CIFSSMBRead DataOffset/DataLength out-of-bounds (WID-SEC-2026-3579) VVulDB Updates6 uur geledenCVE-2026-97562 | Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc2 SMB Client tcon_super_cb use after free (WID-SEC-2026-3579) VVulDB Updates6 uur geledenCVE-2026-97564 | Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc2 cifs.idmap privileges management (WID-SEC-2026-3579) VVulDB Updates6 uur geledenCVE-2026-97565 | Linux Kernel up to 6.18.52/7.2.6/7.3-rc2 SMB Client CIFSSMBRead out-of-bounds (WID-SEC-2026-3579)
+7
11 Quellen
GitHub Release: microsoft/TypeScript v7.1-beta (20.10.2026)
10 weitere Quellen
GGitHub1 uur geledenGitHub Release: google-ai-edge/LiteRT-LM v0.18.1 (20.10.2026) GGitHub4 uur geledenGitHub Release: NousResearch/hermes-agent vrc.1-v0.22.3 (20.10.2026) GGitHub38 min. geledenGitHub Release: cli/cli v2.102.1 (20.10.2026) GGitHub1 dag geledenGitHub Release: cline/cline varchive/pr15095 (19.10.2026) GGitHub2 uur geledenGitHub Release: signalapp/Signal-Desktop v8.32.0 (20.10.2026) GGitHub2 uur geledenGitHub Release: signalapp/Signal-Desktop v8.33.0-beta.1 (20.10.2026)
+4
11 Quellen
CVE-2025-48311 | OffClicks Invisible Optin Plugin up to 1.0 on WordPress cross-site request forgery
10 weitere Quellen
VVulDB Updates5 uur geledenCVE-2025-48321 | Ultimate Twitter Profile Widget Plugin up to 1.0 on WordPress cross-site request forgery VVulDB Updates5 uur geledenCVE-2025-48318 | 多说社会化评论框 Plugin up to 1.2 on WordPress Setting cross-site request forgery VVulDB Updates5 uur geledenCVE-2025-48309 | web-able BetPress Plugin up to 1.0.1 Lite on WordPress cross-site request forgery VVulDB Updates5 uur geledenCVE-2025-48310 | wptableeditor Table Editor Plugin up to 1.6.4 on WordPress cross-site request forgery VVulDB Updates5 uur geledenCVE-2025-48319 | Mesa Reservation Widget Plugin up to 1.0.0 on WordPress cross site scripting VVulDB Updates5 uur geledenCVE-2025-48314 | salubrio Add Code To Head Plugin up to 1.17 on WordPress cross site scripting
+4
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/nl/4285043/it-beveiligingsnieuws/wp2shell-attack-lets-hackers-create-wordpress-admin-accounts-and-install-web-shells-without-login/