Pre-Authentication RCE in WordPress Core

by patrikg • 5 days ago

23 4 5 days ago

Is there meant to be content at this URL?

  < HTTP/2 404 
  < date: Fri, 17 Jul 2026 23:18:29 GMT
  < content-length: 0

ameliaquining• 5 days ago

Works fine for me. There's also the Wayback Machine: https://web.archive.org/web/20260718014646/https://wp2shell....

altairprime2• 5 days ago

Hey, it’s working again now, thanks!

jerrythegerbil• 5 days ago

“Pre-Authentication” and “Unauthenticated” are meaningfully different things, and for the purposes of marketing reach you always want to push for “Unauthenticated” if possible.

Typically Pre-Authenticated means knowing some additional contextual information such as the userID or something like that is required for exploitation, but actual authentication is not required. The impact is limited by how easy it is to know that pre-authentication information, which remains unknown.

Pre-Authentication RCE in WordPress Core

Related Stories