wordpress

9 articles · newest first

Software

600,000 WordPress sites run this form plugin. one bug turns a dropdown into a hacker's backdoor

A file-upload field and a dropdown, sitting on the same form, are all it takes for an unauthenticated attacker to plant PHP code on your site. The fix has existed since July 31 — most sites just haven't installed it.

Kernel · Aug 20 · 6 min

Software

how wp2shell actually works: the two-loop bug that lets an anonymous request run code on WordPress

The exploit hinges on a subtle mistake — WordPress's REST API validates and executes batch requests in two separate loops. When one step fails, everything after it dispatches under the wrong handler. Here's the chain, step by step.

Kernel · Jul 22 · 9 min

Software

what is wp2shell? the WordPress bug that lets a total stranger take over a default site, explained

It's the nickname for a critical flaw in WordPress core — two vulnerabilities chained into a full site takeover with no login required. Here's what it is, whether you're affected, and what to do, in plain English.

Kernel · Jul 22 · 9 min

Software

the WordPress sites getting owned by wp2shell all have one thing in common — and it isn't bad luck

If your WordPress lives on managed hosting, you were probably patched before you'd even read the news. The sites actually exposed to wp2shell share a specific setup — here's whether yours is one of them.

Kernel · Jul 22 · 8 min

Software

you updated WordPress and moved on. here's the 10-minute audit that tells you if you're actually safe — or already owned

Clicking 'update' closes the door. It doesn't check whether someone already walked through it, or whether the other doors are locked. A practical, no-nonsense checklist for after a critical WordPress vulnerability.

Kernel · Jul 22 · 9 min

Software

96% of WordPress security holes are in plugins. wp2shell is one of the 4% that should actually scare you

Most WordPress vulnerabilities live in plugins and themes you can uninstall. A flaw in core itself — reachable on a default install with no add-ons — is a different, rarer animal. The data on why wp2shell stands out.

Kernel · Jul 22 · 8 min

Software

WordPress just updated millions of sites without asking. that's rarer than you think — and here's how to check it worked

The forced auto-update push behind the wp2shell fix is a mechanism WordPress has used only a handful of times. What it is, why they broke the 'we don't touch your site' rule, and how to confirm your install actually got it.

Kernel · Jul 22 · 8 min

Software

there's a second WordPress bug this month — and this one has no patch, just a plugin you need to switch off tonight

While everyone patched the wp2shell core flaw, a 9.8-rated hole in a popular login plugin quietly went public with no fix available. If you run miniOrange's OAuth SSO, updating WordPress didn't save you.

Kernel · Jul 22 · 7 min

Software

wp2shell (CVE-2026-63030): update WordPress now, then check for these signs

No login, no plugin, no odd setup. One anonymous request could take over a default WordPress site. Here is the official advisory in plain English, the fixed versions, and the leftovers that tell you a site was hit.

Kernel · Jul 18 · 6 min