From TimThumb to wp2shell: 25 Years of WordPress Mass Exploitation

TL;DR: wp2shell (CVE-2026-63030 chained with CVE-2026-60137) matters because it is a core, pre-authentication RCE reachable on a stock, plugin-free install. … Continue reading From TimThumb to wp2shell: 25 Years of WordPress Mass Exploitation