Public Exploits Released for Critical wp2shell RCE Vulnerabilities in WordPress Core
Translated by a model; the original is in Russian.
Security researchers have published public exploits for a set of critical vulnerabilities collectively dubbed “wp2shell,” discovered in the WordPress core. The vulnerabilities allow attackers to achieve remote code execution (RCE) on affected sites.
The appearance of working exploits in the public domain sharply increases the risk of mass attacks against WordPress-powered sites, since this CMS runs on a significant portion of the sites on the internet. The availability of ready-made tooling substantially lowers the barrier to entry for would-be attackers.
What administrators should do
Because the vulnerabilities affect the WordPress core itself rather than third-party plugins or themes, every site running an unpatched version of the platform is at risk.
Site administrators are strongly urged to install the available security updates as soon as possible. Delaying patching while public exploits exist creates a real risk of servers being compromised and subsequently used in attacks against third parties.
Details about the specific exploitation mechanisms and the affected WordPress versions are still being disclosed only sparingly, but the mere fact that working exploit code has been published means attacks could begin at any moment.
Source: Bleeping Computer
Comments
Sign in, to comment.