Episode 328 - Wordpress RCE, Vuln Prioritization, AI memory exfiltration

normal work hours type things Good let me think last this last week or so since the The podcast that we had with Cameron and Kurt with the coffee chaos and product guys There's been And there's so much that's going on.

I mean, you know, from a breach perspective, we had the WordPress RCE that just happened.

I didn't even drop a link in there about that in the pre-show notes.

Anything else that you want to call out before we jump into one of these topics for today?

No, not really.

I didn't even know about the WordPress RC, but.

I mean, was it WordPress or WordPress plugin? Cause the plugins like no, it was

WordPress core.

Oh, well, that's different.

So it's called, of course they had to brand it, right? It's called WP2 shell, right? Pre-authentication.

Here's a, here's one link.

I, I don't know.

Like this is, hold on.

Let's see if I can find one that's.

word fence that's 18 hours ago so i mean this is very recent um yeah

holy cow yeah this is really recent i didn't realize i didn't know any of this was going on

yeah um so if you're running wordpress which you probably are somewhere make sure that you have upgraded i know the providers themselves whether it's wordpress.com or wp engine they've just gone out and done a force install on this one But it's the first, you know, in a decade, like WordPress, WordPress core vulnerability, right? It's Adam Coos of AssetNote, right? Discovered and reported by him.

We're going to my sister right now Anyways, doesn't matter.

This is this is good.

I'm glad you mentioned this.

So I don't think I use WordPress anywhere as far as I know But I have an easy way to search so

Yes Yeah, I mean pre authentication.

I haven't dug into it yet as far as like how it's actually Yeah, how it's actually jumping in or how what the what the endpoint is looks like it's wp json batch v1 that's at least the endpoint you can block it at the waf level um it doesn't dig too much into it right oh you can find it here of course wp2 shell.com which is down right now so that's yeah it'll be interesting i'm

impressed

Yeah, is it running WordPress? Did they deploy a vulnerable version? Wow, that would be, I don't know.