wordpress

7 articles · newest first

Software

how wp2shell actually works: the two-loop bug that lets an anonymous request run code on WordPress

The exploit hinges on a subtle mistake — WordPress's REST API validates and executes batch requests in two separate loops. When one step fails, everything after it dispatches under the wrong handler. Here's the chain, step by step.

Priya Nair · Jul 22 · 9 min

Software

what is wp2shell? the WordPress bug that lets a total stranger take over a default site, explained

It's the nickname for a critical flaw in WordPress core — two vulnerabilities chained into a full site takeover with no login required. Here's what it is, whether you're affected, and what to do, in plain English.

Priya Nair · Jul 22 · 9 min

Software

the WordPress sites getting owned by wp2shell all have one thing in common — and it isn't bad luck

If your WordPress lives on managed hosting, you were probably patched before you'd even read the news. The sites actually exposed to wp2shell share a specific setup — here's whether yours is one of them.

Priya Nair · Jul 22 · 8 min

Software

you updated WordPress and moved on. here's the 10-minute audit that tells you if you're actually safe — or already owned

Clicking 'update' closes the door. It doesn't check whether someone already walked through it, or whether the other doors are locked. A practical, no-nonsense checklist for after a critical WordPress vulnerability.

Priya Nair · Jul 22 · 9 min

Software

96% of WordPress security holes are in plugins. wp2shell is one of the 4% that should actually scare you

Most WordPress vulnerabilities live in plugins and themes you can uninstall. A flaw in core itself — reachable on a default install with no add-ons — is a different, rarer animal. The data on why wp2shell stands out.

Priya Nair · Jul 22 · 8 min

Software

WordPress just updated millions of sites without asking. that's rarer than you think — and here's how to check it worked

The forced auto-update push behind the wp2shell fix is a mechanism WordPress has used only a handful of times. What it is, why they broke the 'we don't touch your site' rule, and how to confirm your install actually got it.

Priya Nair · Jul 22 · 8 min

Software

there's a second WordPress bug this month — and this one has no patch, just a plugin you need to switch off tonight

While everyone patched the wp2shell core flaw, a 9.8-rated hole in a popular login plugin quietly went public with no fix available. If you run miniOrange's OAuth SSO, updating WordPress didn't save you.

Priya Nair · Jul 22 · 7 min