Elektrine
Log in Register

#wordpress

214 posts · Last used 3d

Back to Timeline
cyberworldops
CyberWorldOps @cyberworldops@infosec.exchange · 3d ago
BdThemes, a WordPress premium tool developer, was compromised in a supply-chain attack. Attackers injected malicious JavaScript into a remote JSON feed rendered in WordPress admin panels, enabling automatic creation of rogue administrator accounts on victim sites. #SupplyChainAttack #WordPress #BdThemes #Cybersecurity https://cyberworldops.eu/en/bdthemes-compromised-wordpress-supply-chain-attack-creates-rogue
0
0
0
bstnbuck
Bastian Buck @bstnbuck@infosec.exchange · 4d ago
A #Wordpress site belonging to an friend (I’m not the admin...) was successfully hacked using #wp2shell (17.07.2026; #CVE-2026-63030), just 5 days after the first exploit published (20.07.). Another 5 days later, the website was abused for SEO spamming and for hosting phishing… If you haven't already, update your Wordpress (preferably yesterday…) and also enable automatic updates for themes and plug-ins! I found several PHP backdoors/webshells (see @abuse_ch@ioc.exchange Malware Bazaar and #VirusTotal (hashes below)). Interestingly, not every sample was detected by the #YARA rules from @cyb3rops@infosec.exchange and https://github.com/ruppde/yara_rules tl;dr #wp2shell is being actively exploited, patch immediately and enable automatic updates. Hashes: 1093b4045b45a8498d146e31788c25769f992056c8ffc582b5d8c06598598966 05e3884a478d3bc8fd7285dabb74107422f1615d2d7f80df9b8438d4beb663da bb9136494a546368e7c9b6252c2e1c5af9327c07947908a9ba6fdd78fb4bf4cf 1e7ca9074cc2eca8d366022629f665d9ffaa79e0621bb579bf5aabe681cb07e8 8ebaf3ba0be7b62269aaf333cfaf66c1dea6e8ee495a917691beb550b4bbf0ab e3fb920aa70c7ad5c67b4d9b8e60954f5e0c1a07c0eba09505816b966f4d1a3c 165e94c87ef17389c8de25ba2a6c31b348e3c916dab89d0dd3708156414f3de5 b55cf5af8b57e9d56c69d00e023e2384c7eb184614c2a2a283062ebeaf4a26c6 a46230a1638b9b341d15a640ead1b885548c1d1e5a149657e8e315540a068be8 7918f29993383e579ef33bd0d8e766fd2ce047dce83bac51efb5fe17578b6cdf ae9ee9db7c41e04c531298782b908766c769a899aa92df3f64f4a83baa77ad09
0
0
0
niebezpiecznikbot
Niebezpiecznik News @niebezpiecznikbot@mastodon.com.pl · 4d ago
Nowy atak na WordPressa znaleziony przez AI: od XSS do admina i wykonania dowolnego kodu PHP Dziura znajduje się we wszystkich wersjach WordPressa aż do 7.0.3 (niezależnie od zainstalowanych pluginów) i pozwala atakującemu stać się administratorem bloga, a nawet wykonać dowolny kod PHP po stronie serwera. Atak bazuje na podatności XSS w wariancie pre-auth, czyli nie jest wymagane, aby atakujący miał konto użytkownika na atakowanym blogu. Atak XSS2shell Ta podatność XSS została odkryta w wp-login.php i aby ją wywołać należy przeprowadzić próbę logowania na użytkownika, który nie istnieje. WordPress przepuszcza wtedy błędny login przez funkcję strip_tags(), a później przez filtr wp_kses_post(). Pierwszy parser nie widzi znacznika, jeśli po znaku “<” jest spacja. Drugi interpretuje go jako dozwolony HTML. W efekcie, w komunikacie o błędnym logowaniu powstają elementy DOM kontrolowane przez atakującego. Ścieżka ataku bazuje na technice SOME, czyli Same Origin Method Execution. Callback odwołuje się do przycisku w innym oknie tej samej domeny i wywołuje click(). Jeśli chcesz zrozumieć, jak wyrywać takie podatności i jak budować takie ataki oraz dlaczego czasem jedna spacja wystarcza do ominięcia filtra po stronie aplikacji, to rzuć okiem na niebezpiecznikowy Kurs Ataków XSS. Tylko do końca dzisiejszego dnia sprzedajemy go w niższej o 30% cenie i dajemy wieczysty dostęp zarówno do materiałów (30 lekcji, ponad 3h materiału) jak i do środowiska labowego, gdzie w praktyce wykonasz wszystkie ataki. Dostęp jest na zawsze, ale niższa cena tylko dziś. Dlatego nie przegap tej okazji, bo do nauki możesz siąść nawet za pół roku, jeśli teraz nie masz na to czasu: Admin musi kilknąć (świadomie lub nie) w podstawiony link Warto jednak zauważyć, że aby uzbroić tę podatność i umożliwić przejęcie [...] #Wordpress #XSS https://niebezpiecznik.pl/post/nowy-atak-na-wordpressa-znaleziony-przez-ai-od-xss-do-admina-i-wykonania-dowolnego-kodu-php/
0
0
0
offseq
OffSequence @offseq@infosec.exchange · 4d ago
CVE-2026-16985: Squeeze WP plugin <1.7.12 has a CRITICAL vuln — users with upload_files can upload PHP files, enabling remote code execution. Restrict permissions, monitor uploads, and check for updates. https://radar.offseq.com/threat/cve-2026-16985-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-squeeze-a1de64d348b6591f #OffSeq #WordPress #CVE2026_16985 #infosec
0
0
0
drewph
Drew 🇵🇭 @drewph@ieji.de · 4d ago

#Today #3Things

  1. I managed to isolate a residential proxy botnet that was hammering one of my client servers, and after adding some new htaccess rules, I've got CPU and RAM use down from 95% to about 25% and no more 503 errors. #Tech #WordPress #VPS #Hosting #DDoS

  2. Monitoring my posture more carefully while at my desk working (and playing). My #interoception is a bit unreliable like many #neurodivergent folk, but a mindful body scan approach may help, if I can stay aware of it. My trouble is that I get so absorbed in what I'm doing, nothing else exists.

  3. View from one of my study windows this morning. More controlled and supervised burning in the southmost hectare, in preparation for cultivation. #Farming #FarmLife

0
0
0
decio
:mastodon: decio @decio@infosec.exchange · 4d ago
Replying to @decio@infosec.exchange
Dans la suite de wp2shell, encore une jolie chaîne WordPress : #XSS2Shell — CVE-2026-64638. Au départ, on a “juste” une Reflected XSS pré-auth sur wp-login.php. Sauf qu’en la chaînant avec plusieurs briques déjà présentes dans WordPress, on arrive à quelque chose de beaucoup moins sympa : XSS → contexte admin → Application Password → REST API → upload de plugin → RCE 🐚 ⚠️ À noter quand même : ce n’est pas du pre-auth zero-click. Il faut qu’un admin déjà connecté clique sur un lien contrôlé par l’attaquant. Encore un bon rappel : une “simple XSS” peut devenir franchement méchante une fois mise dans la bonne chaîne. 🩹 Corrigé dans WordPress 7.0.3. 👇 https://wordpress.org/news/2026/08/wordpress-7-0-3-release/ En cas de doute sur une exploitation passée : petit coup d’œil aux Application Passwords, aux plugins récemment ajoutés et aux fichiers PHP inhabituels. "XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638)" 👇 https://pwn.ai/blog/xss2shell #WordPress #XSS2Shell #CyberVeille
0
0
0
wpguyuk
The WordPress Guy @wpguyuk@infosec.exchange · 4d ago
With 59,000+ free plugins available, the question is never just "which plugin does this job" — it is "which plugin does this job without costing more than it delivers." Quality beats quantity every time. A lean set of well-coded plugins will always outperform a bloated collection. #WordPress #WebPerformance #WordPressPlugins #PerformanceOptimisation https://wpguy.uk/blog/which-wordpress-plugins-actually-improve-site-speed-and-business-performance/
0
0
0
offseq
OffSequence @offseq@infosec.exchange · 6d ago
CVE-2026-16594: WP Directory Kit <1.5.5 has a HIGH severity info exposure flaw. Any authenticated user (even Subscribers) can access API keys/secrets due to missing authorization on AJAX action. Restrict user roles & monitor logs. https://radar.offseq.com/threat/cve-2026-16594-cwe-200-information-exposure-in-wp-directory-kit-3d8a39f4c5fd7c8a #OffSeq #WordPress #CVE
0
0
0
offseq
OffSequence @offseq@infosec.exchange · 6d ago
CVE-2026-16955: HIGH severity path traversal in AI Engine WP plugin <3.6.6. Subscribers can read arbitrary files if public API is enabled. Restrict API & admin privileges. Await patch. https://radar.offseq.com/threat/cve-2026-16955-cwe-22-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-ai-72905be644e71053 #OffSeq #WordPress #CVE2026_16955 #Security
0
0
0
tomcat
tomcat @tomcat@infosec.exchange · Aug 07, 2026
‼️ BREAKING - A newly discovered #WordPress pre-auth XSS affects every version. XSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution. Update your WordPress sites ASAP 🠖 https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html
0
0
0
elettrona
Elena Brescacin @elettrona@poliversity.it · Aug 07, 2026
Let me say this: now that Matt Mullenweg has explicitly declared he doesn't really care about WordPress accessibility, I'm exploring alternatives. I have PureBlog and Eleventy currently in hand; Ghost is potent but its accessibility is very, very poor. My strong fear on switching to another platform, however, is one: there are less and less skilled people on CSS code. Most are used to point-and-click palettes, and I could code but due to my blindness I have no feedbacks on how my pages appear so I have a need for sighted assistance to customize CSS. What the hell should I do? #a11y #accessibility #blind #inclusion #WordPress
1
0
11
2ndStar
Dark*:*Star :antifa: @2ndStar@astronomy.social · Aug 06, 2026
Replying to @2ndStar@astronomy.social

Hier ist der böse Bösewicht :-) Diese IP hat es nochmal versucht und heute nacht alles abgeklopft, ob ich ihm was übrig gelassen habe. Nachdem ich die Malware entfernt habe, kamen wenige Stunden später zwei Wellen automatisierter Kontrollanfragen auf genau die individuellen Backdoor-Dateien! Die Logdatei verrät hier, dass der Scanner die ehemalige Installation kennt. Er probiert hier nicht wahllos z. B. wp-admin oder xmlrpc, sondern genau die individuellen Artefakte seiner früheren Malware.

root@xx:~# qm guest exec 200 -- sh -c 'grep "216.194.167.162" /var/log/apache2/xxx_access.log'

Was habe ich gestern alles getan?

  • WordPress-Core ersetzt
  • Backdoors und MU-Plugins entfernt
  • kompromittiertes (ein altes vergessenes) Theme entfernt
  • REST-RCE beseitigt
  • Cron-Persistenz entfernt
  • Passwörter geändert
  • Salts rotiert
  • Apache bereinigt
  • MySQL nur noch auf 127.0.0.1 und 3306 explizit getestet, dass er nicht von außen erreichbar ist
  • Fail2ban repariert
  • doppelte iptables-Regeln entfernt
  • Angreifer-IP dauerhaft gesperrt
  • Logfiles ausgewertet (Angreifer beobachtet -> 404 auf die nun entfernte Backdoor)

Das war hier ein mehrstufiges Backdoor-Framework. Die Malware nutzt hier

  • Must-Use-Plugins
  • individuelle Dateinamen/Tokens
  • Health-Checks
  • Remote Command Execution
  • Persistenz
  • Selbsttests
  • regelmäßige Kontrollanfragen

#WordPress #Malware

14
3
3
gMoon
Gregory 🇨🇦 (Open to work) @gMoon@aus.social · Aug 05, 2026
Canadian job & contract leads (any duration), I'm not affiliated with any of these companies: Faire has 16 different openings for either remote (in Ontario), Toronto (Ontario), or Kitchener-Waterloo (Ontario). Salary is listed within the job posting. See all their openings at https://www.faire.com/careers/openings AlphaPay is hiring for three positions in Richmond, BC, they are: Back-End Developer, Front-End Developer, Sales and Key Account Manager. No salary range is provided. See https://www.alphapay.com/career/ for details. EDC (Export Development Canada) is hiring for a number of different positions across Canada (all are hybrid positions, some list an exact location while others list multiple potential locations). Salary range and application deadline are listed in the job posting. See https://apply.workable.com/export-development-canada/?lng=en for their openings (there are postings in English and French). Awesome Motive is hiring a Growth Manager (remote position, in the list of locations it includes Canada). "This role requires a minimum daily overlap of 9 AM to 1 PM US Eastern Time." No salary range listed. Apply at https://apply.workable.com/awesomemotive/j/426BC71356/ KEV is hiring a Manager, Software Engineering in Toronto, Ontario (hybrid position). Required question on application asks if you can work hybrid from their Toronto or Cambridge (both Ontario) office three days a week. Salary range is $150,000 - 189,000. Details to apply are at https://kevgroup.com/open-positions/?gh_jid=5204272007 vit is looking for a Developer Relations Engineer in Toronto, Ontario (on site at their office). Salary range is $160k – $180k. "Candidates require valid authorization to work in Canada" Details and apply at https://www.vlt.io/careers/developer-relations-engineer Compass Group Canada is hiring a head of customer engagement in Mississauga, Ontario. The salary range is $180,000 to $190,000. Job description and link to apply is at https://careers.compass-canada.com/job/23666505/head-of-customer-engagement/ #WPJobs #WPCareers #WordPressJobs #CanadaJobs #CanadianJobs #DevJobs #WebDevJobs #WordPress #FediHired #GetFediHired #hiring #RemoteJobs #FediJobs #ITJobs #JobAlert #TechJobs #ToJobs #TorontoJobs #CalgaryJobs #WinnipegJobs #RemoteWork #FediHire #Job #Jobs #JobOpenings #OpenRoles
1
0
0
offseq
OffSequence @offseq@infosec.exchange · Aug 05, 2026
Kadence Memberships (stellarwp) ≤4.0.0 suffers CRITICAL vuln (CVE-2026-9273, CVSS 9.3): attackers can hijack any account by poisoning password reset links. Restrict reset features & monitor for patches. https://radar.offseq.com/threat/cve-2026-9273-cwe-640-weak-password-recovery-mechanism-for-forgotten-password-in-stellarwp-membership-10c6cffc948a3c97 #OffSeq #WordPress #Vuln #Security
0
0
0
thephpf
The PHP Foundation @thephpf@phpc.social · Aug 04, 2026
We have a new addition to The PHP Foundation Governing Board: Anne McCarthy from Automattic. Anne brings a balanced mix of thoughtful empathy and deep technical knowledge and will bring tremendous insight to the Board. Welcome, Anne! Read more https://thephp.foundation/blog/2026/08/04/anne-mccarthy-joins-the-board/👇 #php #automattic #wordpress #phpcommunity
6
1
3
stefanfrede
Stefan Frede @stefanfrede@mastodon.social · Aug 03, 2026
Once again, I must praise @ddev@fosstodon.org! It helps to get projects up and running quickly, and the maintainers are always available to assist if any issues arise. I don't know of many projects where the maintainers are as dedicated to their users as these ones are. If you haven't used #DDEV to set up, for example, #WordPress, I recommend giving it a try. If you can, please consider sponsoring them: https://ddev.com/sponsor/
1
0
0
MartinGuay
🍁 Martin Guay 👨‍💻🌈🎮📱 @MartinGuay@mstdn.ca · Aug 02, 2026
Most WordPress cache warmers act like a micro-DDoS attack against your origin server—locking MySQL tables and starving execution threads. We engineered Cryovex Edge Prime: a stateful, self-healing cache engine with 3-state circuit breakers, direct-loopback failovers, and primary-key batch compaction. Read the full engineering roadmap from v0 to v2.6.0: https://medium.com/@martinguayott/wordpress-cache-warmer-why-yours-fails-how-we-fixed-it-21cbaaab0423 #WordPress #DevOps #SysAdmin #WebPerf #SoftwareEngineering
2
1
1