build1 publisher
Click2Shell turns a 5.3-rated WordPress selector injection into PHP on the server
The WordPress Core bug alone scores 5.3. In a research proof of concept it installs an official catalog theme inside the administrator's browser, the Customizer preview loads that theme's functions.php, and a second bug runs the attacker's PHP.
Publishers:dev.to
Reality
- Evidence52
- Adoption25
- Hype gap+15
- Incentives55
- Confidence50