HTTP2Shell is real: I turned one WordPress pingback into a Bash shell

on

I reproduced a full unauthenticated RCE chain against a pinned, 21 October Docker Official Image for WordPress, triggered through /xmlrpc.php.

The chain fires from a single inbound pingback.ping call, which triggers two outbound fetches within the same PHP request. It works with ASLR enabled, needs no memory leak, and requires no cross-request heap grooming.

Note: this PoC targets one exact vulnerable image digest, it does not work against current wordpress:latest builds or WordPress core itself.

Repo: https://github.com/caveeroo/cve-2026-111497-wordpress-poc

submitted by /u/Z33S
[link] [comments]

from hacking: security in practice https://ift.tt/JHpFSiP

Comments

Post a Comment