A pre-authentication XSS to RCE chain in WordPress Core that allows unauthenticated attackers to achieve remote code execution on any default WordPress installation through the login page.

You can outsource the hacking, but not the understanding

Stay current: Get research alerts for newly disclosed vulnerabilities and exposures If you're running WordPress and want to check if your instance is vulnerable, you can use our tool we've hosted here: https://wp2shell.com/. We held off on publishing this issue to give defenders a chance to upgrade their WordPress instances over the weekend, but during

Post SMTP Plugin (= 3.2.0) Privilege Escalation Vulnerability Walkthrough Vulnerability Report CVE ID: CVE-2025-24000 Plugin: Post SMTP Type: Privilege Escalation via Broken Authentication Vulnerable Version: = 3.2.0 Fixed Version: 3.3.0 Patch Priority: High CVSS Score: 8.8 (High) OWASP Classification: A7: Identification and Authentication Failures Discovered by: Denver Jackson Published: July 21, 2025 Overview The WordPress plugin "Post SMTP"

How pwn.ai turned a routine client pentest into multiple ImageMagick zero-days. By autonomously researching the product’s internals for days, it found a path from a single image upload to file leaks, security policy bypasses, and remote code execution across a wide range of default and real-world configurations.

🔍 Overview

🚨 A critical flaw in Post SMTP (≤3.2.0) let Subscriber users access email logs, intercept reset links, and take over admin accounts. ✅ Update to 3.3.0 now to stay protected!

Unauthenticated privilege escalation vulnerability discovered in the Modular DS plugin. 🚨 Learn how attackers gain wp-admin access, active exploitation details, and how to stay protected.

The WP GDPR Compliance plugin allows unauthenticated users to execute any action and update any database value. This vulnerability is due to the lack of proper validation in the Includes/Ajax.php file.

🚨 A critical unpatched vulnerability in the TI WooCommerce Wishlist plugin allows unauthenticated file uploads and potential RCE. Over 100K sites affected. As usual, Patchstack users are protected. 🛡️

Please upgrade your Elementor websites

How to semi-automatically find vulnerabilities in WordPress plugins installed on about 10 million websites.

Security Research & Bug Bounty Hunter

This blog post details how a combination of a Path Traversal and Local File Inclusion vulnerability lead to Remote Code Execution in the WordPress core. The vulnerability remained uncovered in the Wor…