Get on Slack/Teams RSS
Last updated: August 19, 2026 at 1:47 AM UTC
All 741 Vulnerability 286 Breach 129 Threat 319 Defense 7
Tag: pre-auth-rce (3 articles)Clear
vulnerability
2026-07-28

Public exploit reaches PHP eval in vBulletin for unauthenticated code execution

Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval function inside vBulletin and run code on an unpatched forum server. The attack needs no account, administrative access, or interaction from another user, making any internet-facing vulnerable forum a direct target. SSD Secure Disclosure lists vBulletin 6.2.1 and earlier and 6.1.6 and earlier as affected, without giving a lower version boundary. Forum software is an attractive target because it is public by design, often runs with limited maintenance, and a single compromised server can host web shells, redirect visitors, or expose community member data. Administrators should confirm their version and patch level.

vbulletinpre-auth-rcephp-evalforumpublic-exploit
Check
Confirm the vBulletin version on any forum you run, apply the vendor's patches, and inspect the server for web shells and unexpected PHP files given that a public exploit exists.
Affected
Internet-facing vBulletin forums on 6.2.1 and earlier or 6.1.6 and earlier; an unauthenticated request reaches PHP eval for remote code execution, and working exploit details are now public.
Fix
Update vBulletin to a patched release, place a web application firewall in front of the forum, restrict server file writes, and monitor for unexpected processes spawned by the web server.
vulnerability
CVE-2026-63030CVE-2026-60137
2026-07-20

Public exploits released for WordPress core flaws that give anonymous code execution

Public exploit code is now available for wp2shell, a pair of WordPress core flaws that chain into pre-authentication remote code execution against a stock site with no plugins installed. CVE-2026-63030 is a route confusion bug in the REST API batch endpoint, which has shipped enabled by default since 2020, and CVE-2026-60137 is a SQL injection in the author parameter handling of WP_Query. Chained, an anonymous HTTP request can run code on the server. The chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, fixed in 6.9.5 and 7.0.2, and WordPress enabled forced automatic updates given the severity.

wordpresswp2shellpre-auth-rcerest-apisql-injection
Check
Confirm every WordPress site you run, including forgotten and staging instances, is on 6.9.5 or 7.0.2 or later, then check logs and web directories for web shells.
Affected
Any site on WordPress 6.9.0 to 6.9.4 or 7.0.0 to 7.0.1 (CVE-2026-63030, CVE-2026-60137); no plugins, login, or user interaction are needed, and working exploits are public.
Fix
Update to WordPress 6.9.5 or 7.0.2, confirm auto-updates applied, put a web application firewall in front of exposed sites, and treat unpatched internet-facing installs as potentially compromised.
vulnerability
CVE-2026-8037
2026-07-01

Critical Kemp LoadMaster flaw gives unauthenticated attackers root on edge appliances

A critical flaw in Progress Kemp LoadMaster lets an unauthenticated attacker run commands as root on the appliance by sending a crafted request to its API. Rated 9.8, the bug (CVE-2026-8037) sits in a function meant to sanitize input before it reaches a shell command, and LoadMaster's position as an edge load balancer and application delivery controller makes a pre-authentication flaw especially dangerous, since it can turn a protective choke point into a direct foothold. Progress patched it in early June, and researchers at watchTowr published a full technical write-up with a working proof-of-concept on June 29. No exploitation has been reported yet, but Progress also makes MOVEit, a past mass-exploitation target.

kemp-loadmasterprogresspre-auth-rceedge-applianceapi
Check
Identify Progress Kemp LoadMaster appliances with the API enabled, confirm their versions, and determine whether the management API is reachable from untrusted networks or the internet, the exposure this flaw needs.
Affected
Kemp LoadMaster GA 7.2.63.1 and earlier and LTSF 7.2.54.17 and earlier with the API enabled (CVE-2026-8037); an unauthenticated attacker who can reach the API gains root on an edge device.
Fix
Update to LoadMaster GA 7.2.63.2 or LTSF 7.2.54.18, and question whether the management API needs to be reachable at all, restricting it to trusted management networks or disabling it where unused.