1.CVE-2026-111497: Unauthenticated WordPress RCE Exploit Chain PoC via Brotli Decoder Flawvulnerability | Critical | 2026-10-28 22:42 | CVE-2026-111497 | github.com | Original ↗ | .md | #rce | #wordpress | #red-team
2.WordPress Core Unauthenticated Path Traversal to LFI & RCE PoC (CVE-2026-87902)vulnerability | High | 2026-09-22 18:40 | CVE-2026-87902 | github.com | Original ↗ | .md | #bug-bounty | #rce | #wordpress
3.Comment2Shell: Zero-Click Pre-Auth RCE Exploit Kit for WordPress (CVE-2026-93485)tool | 2026-09-25 00:13 | CVE-2026-93485 | github.com | Original ↗ | .md | #bug-bounty | #rce | #zero-day
4.Click2Shell: Preauth WordPress Core Theme Preview Injection to RCE Chainvulnerability | 2026-09-18 15:05 | pwn.ai | Original ↗ | .md | #ai-security | #rce | #wordpress
5.CVE-2026-32475: Elementor Pro Forms Unauthenticated Arbitrary File Upload to RCE Lab & PoCvulnerability | Critical | 2026-09-05 06:23 | CVE-2026-32475 | github.com | Original ↗ | .md | #bug-bounty | #rce | #wordpress
6.dinosn/givewp-cve-2026-82222-rce-lab: GiveWP CVE-2026-82222 RCE Docker Lab & PoCresearch | 2026-08-30 05:15 | CVE-2026-82222 | github.com | Original ↗ | .md | #rce | #php | #wordpress
7.Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilitiesvulnerability | 2026-08-26 00:00 | CVE-2023-49105 | hunt.io | Original ↗ | .md | #rce | #threat-intelligence | #attack-surface
8.XSS2Shell: WordPress pre-auth XSS to RCE chain (CVE-2026-64638)vulnerability | High | 2026-08-07 15:25 | CVE-2026-64638 | pwn.ai | Original ↗ | .md | #ai-security | #rce | #public-poc
9.CVE-2026-15748 — WPMU DEV Forminator Forms Select Field Injection Unrestricted File Uploadresearch | 2026-08-18 00:00 | CVE-2026-15748 | aretiq.ai | Original ↗ | .md | #ai-security | #rce | #wordpress
10.CVE-2026-61967 — miniOrange OTP Verification Ultimate Member Password Reset Authentication Bypassresearch | 2026-08-15 00:00 | CVE-2026-61967 | aretiq.ai | Original ↗ | .md | #ai-security | #authentication-bypass | #wordpress
11.[CVE-2009-2854] The WordPress Chain Massacreresearch | 2026-08-05 00:00 | CVE-2009-2854 | calif.io | Original ↗ | .md | #vulnerability-research | #linux | #web-security
12.Unauthenticated RCE in WordPress core (wp2shell), via SQL injectionvulnerability | Critical | 2026-07-17 00:00 | CVE-2026-63030 | aikido.dev | Original ↗ | .md | #rce | #featured | #vulnerability-research
13.CVE-2026-63030 & CVE-2026-60137: WordPress Core Pre-Authentication RCE Overview & Takeawaysvulnerability | 2026-07-20 00:00 | netspi.com | Original ↗ | .md | #rce | #wordpress | #sqli
14.SQL injection isn't deadblog | 2026-07-22 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #rce | #appsec
15.Exploitation in the Wild of wp2shellblog | 2026-07-20 18:00 | wiz.io | Original ↗ | .md | #rce | #wordpress | #vulnerability
16.How Two WordPress Core Bugs Chained into Pre-Auth RCEresearch | 2026-07-18 00:00 | bugbunny.ai | Original ↗ | .md | #rce | #vulnerability-research | #attack-chains
17.Could Modern Code Review Have Prevented wp2shell?blog | 2026-07-19 00:00 | hacktron.ai | Original ↗ | .md | #code-review | #wordpress | #sast
18.CVE-2026-8206 — Themeum Kirki WordPress Plugin Password Reset Email Redirect Privilege Escalationresearch | 2026-06-02 00:00 | CVE-2026-8206 | aretiq.ai | Original ↗ | .md | #appsec | #vulnerability-research | #account-takeover
19.CVE-2026-48866 — WordPress Gravity Forms Plugin File Upload Path Traversal Arbitrary File Deletionresearch | 2026-06-01 00:00 | CVE-2026-48866 | aretiq.ai | Original ↗ | .md | #vulnerability-research | #web-security | #wordpress
20.Critical auth bypass in WordPress Azure AD SSO plugin due to missing OIDC id_token validationvulnerability | Critical | 2026-04-10 07:36 | CVE-2026-2628 | yeswehack.com | Original ↗ | .md | #cloud | #authentication-bypass | #wordpress
21.Getting Shells at Terminal Velocity with Wopperblog | 2025-04-23 00:00 | netspi.com | Original ↗ | .md | #php | #wordpress | #red-team
22.URLx Just Got Bigger: 10.6B URLs for Recon and Malicious Infrastructure Huntingblog | 2025-03-27 00:00 | hunt.io | Original ↗ | .md | #wordpress | #threat-hunting | #dprk
23.Wordpress Plugin Vulnerability Huntingvulnerability | 2024-08-27 05:01 | projectblack.io | Original ↗ | .md | #vulnerability-research | #wordpress | #sast
24.XBOW Battles Ninja Tables: Who’s the Real Ninja?vulnerability | 2024-08-14 12:00 | xbow.com | Original ↗ | .md | #bug-bounty | #arbitrary-file-read | #vulnerability-research
25.How Serialized Cookies Led to RCE on a WordPress Websiteblog | 2024-05-09 16:11 | hackerone.com | Original ↗ | .md | #bug-bounty | #rce | #nextcloud
26.WP Coder, Version 2.5.3 Advisoryvulnerability | 2023-04-13 00:00 | CVE-2023-0895 | bishopfox.com | Original ↗ | .md | #sql-injection | #wordpress | #vulnerability
27.Log HTTP Requests, Version 1.3.1, Advisoryvulnerability | 2022-11-21 00:00 | CVE-2022-3402 | bishopfox.com | Original ↗ | .md | #web-security | #wordpress | #xss
28.Novel Attack Vector to Bypass CSP Via Same Origin Method Execution (Wordpress Zeroday)blog | 2022-05-29 11:00 | pwn.ai | Original ↗ | .md | #vulnerability-research | #wordpress | #xss
29.Reports from the Field: Part 1blog | 2022-03-01 00:00 | bishopfox.com | Original ↗ | .md | #data-exposure | #wordpress | #incident-analysis
30.Top 10 web hacking techniques of 2018research | 2021-01-05 14:10 | portswigger.net | Original ↗ | .md | #web-security | #wordpress | #research