https://hackingpassion.com/tags/rest-api/Recent content in REST API on HackingPassion.com : root@HackingPassion.com-[~]HugoenSat, 18 Jul 2026 12:59:44 +0200https://hackingpassion.com/wordpress-wp2shell-rce/Sat, 18 Jul 2026 12:59:44 +0200https://hackingpassion.com/wordpress-wp2shell-rce/<p>A hole in WordPress handed your database to someone who never logged in. For 227 days it took one request. It needed no password and no plugin, just an address that has been part of WordPress since December 2020. 🧐</p> <p><strong>The patch is the problem.</strong></p> <p>WordPress is open source, so the repair had to be published. It went up on Friday afternoon: three commits, three files, timestamped 16:27 UTC. Put the old version next to the new one and you can read what was broken.</p>