Well, we had another WordPress core remote code execution vulnerability published yesterday. This one is confused deputy vulnerability that allows anyone to install a theme from the wordpress theme repo. There are about 30 that include POP chains to get full code execution. The vulnerability does require Admin interaction…
Details posted here: https://bitfire.co/en/cve/cve-2026-unassigned-double-decode-template-server-side-include-vulnerability
Leave a Reply