Critical WordPress 'wp2shell' RCE flaws get public exploits, patch now

🚨 ACTIVE EXPLOITATION

• Critical WordPress 'wp2shell' RCE flaws get public exploits, patch now — bleepingcomputer.com
  Public exploits released for critical pre-authentication remote code execution vulnerabilities in WordPress Core.
  • Affects WordPress Core versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1
  • Two chained vulnerabilities: CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection)
  • Allows unauthenticated remote code execution on default WordPress installs with no plugins
  • Exploits use SQL injection to extract password hashes, crack admin credentials, upload malicious plugins, or achieve RCE without credentials
  • Public proof-of-concept exploits and in-the-wild attacks reported after delayed disclosure

🕵️ RESEARCH & DEEP DIVES

• Four-Stage Bitmap-Steganography Dropper Delivers AsyncRAT 0.5.8 via .NET Chain — blog.threatuniverse.co.uk
  A four-stage .NET dropper uses bitmap steganography to deliver AsyncRAT 0.5.8.

  • Targets Windows .NET Framework 4.5 with a multi-stage loader disguised as Armenian water-cycle simulation
  • Uses two bitmap resources with distinct pixel-encoding steganography carrying encrypted payloads
  • Stages include ConfuserEx and Eazfuscator obfuscation, Defender tampering, persistence, and process hollowing
  • Final payload is AsyncRAT 0.5.8 with disabled installation and anti-analysis features, communicating via TLS to dynamic DNS C2
  • Static analysis extracted all stages and config without execution; loader embeds legitimate epidemiology simulator as cover

• AstrBot API suffers authentication and authorization bypass vulnerabilities up to version 4.25.5 — cve.threatint.com
  AstrBot API up to version 4.25.5 has authentication and authorization bypass vulnerabilities.

  • Applies to AstrBotDevs AstrBot versions up to 4.25.5
  • Vulnerabilities in API functions OpenApiRoute.chat_send and OpenApiRoute.get_chat_sessions
  • Authentication bypass via spoofing Username argument in chat_send function
  • Authorization bypass via manipulation of Username argument in get_chat_sessions function
  • Both vulnerabilities allow remote exploitation and have publicly disclosed exploits

• Insecure PRNG in urwid Web Backend Exposes Session IDs and Enables Code Injection — cve.threatint.com
  The urwid web display backend uses a weak PRNG that exposes session IDs and allows code injection.

  • Applies to all versions of the urwid web display backend (urwid/display/web.py)
  • Session IDs (urwid_id) are generated using Python's Mersenne Twister PRNG, which is not cryptographically secure
  • An attacker observing ~334 session IDs can reconstruct the PRNG state to predict past and future IDs
  • Session IDs are used as filenames in a world-listable /tmp directory, allowing local users to enumerate active sessions
  • With a valid session ID, attackers can read terminal screens, inject keystrokes, and execute OS-level code with session owner privileges

🔓 CVEs & KEV

• CVE-2026-16128 — CVSS 7.3
• CVE-2026-16127 — CVSS 7.3
• CVE-2026-16126 — CVSS 7.3
• CVE-2026-16125 — CVSS 7.3
• CVE-2026-16124 — CVSS 6.3
• CVE-2026-16123 — CVSS 6.3
• CVE-2026-16129 — CVSS 5.3
• CVE-2026-16130