Exploit for CVE-2026-63030

wp2shell — CVE-2026-63030 + CVE-2026-60137 One-day WordPres...

Hackers Exploit Outdated WordPress Plugin to Backdoor Thousands of WordPress Sites

Threat actors have been observed leveraging a legitimate but outdated WordPress plugin to surreptitiously backdoor websites as part of an ongoing campaign, Sucuri revealed in a report published last week. The plugin in question is Eval PHP, released by a developer named flashpixx. It allows users...

WordPress Custom字段任意文件上传漏洞

WordPress是一款基于WEB的网络日记程序。 WordPress custom字段处理存在任意文件上传问题，远程攻击者可以利用漏洞上传PHP脚本文件并以WEB进程权限执行。 WordPress允许上传受限制的文件附件，名字标题和其他值存储在posttype=attachment的wpposts表中，路径和其他文件属性使用特定字段wpattachedfile和wpattachmentmetadata中的wppostmeta表中。...