statementSaid on 2026-07-21
Due to a serious vulnerability in the WordPress system and the REST API mechanism, an attacker can remotely break into the server without any additional information (such as login-password) (RCE).
A statement by turansecurity, said on 2026-07-21. Statements are as reported by the cited publishers — not verified by DecisionGateway.
WordPress tizimi va REST API mexanizmidagi jiddiy zaiflik sabab hujumchi hech qanday qo'shimcha ma'lumotlarsiz (masalan, login-parol) serverga masofadan buzib kirishi mumkin (RCE).
Related claims
A serious vulnerability rated 9.8 was discovered in WordPress (CVE-2026-63030).turansecurity · investigationThe vulnerability exists in WordPress 6.9.x (up to 6.9.5) and 7.0.x (up to 7.0.2) versions.turansecurity · statementThe vulnerability can cause memory corruption, service disruption, and in some cases remote execution of malicious code via specially crafted compressed data.Turan Security Xavfsizlik Byulleteni · statementBecause authentication checks in the Repository commits API are insufficient, a remote unauthenticated attacker can read arbitrary files on the server, including configurations, tokens, keys and credentials.Turan Security xavfsizlik byulleteni · allegationTwo security flaws in PHP could allow attackers to execute malicious code remotely.THnewsupdates · allegationTwo critical vulnerabilities have been confirmed in PHP, distributed under the name PHP2Shell, and they create a risk of remote malicious code execution on the server and unauthorized access to data.Turan Security Xavfsizlik Byulleteni · allegation
More claims by turansecurity
Red Hat Build of Keycloak users should apply RHSA-2026:56519 / 56520 / 56523 / 56524.commitmentUpgrade to 26.7.2 / 26.6.6 / 26.4.15 (LTS); the fix is also available in 26.8.0.commitmentUnsupported branches (26.5, 26.3 and older) will not be fixed and remain permanently vulnerable until upgraded.predictionAll versions prior to 26.7.2, 26.6.6 and 26.4.15 (LTS) are affected.statementExploit code has not yet been distributed, but the CVE is confirmed.statement
All claims by turansecurity