Hello and welcome to the Tuesday, July 21st,

2006 edition of the Sands and then at Storms, Stormcast. My name is Johannes Ulrich,

recording today from Jacksonville, Florida. And this episode is brought you by the sands.edu graduate certificate program in

industrial control system security.

Well, yesterday I mentioned the WordPress vulnerability that hadn't exploit available and

yes, was already actively exploited.

Today I took the time to set up a vulnerable

WordPress instance and a reader also suggested or sent me some logs that they collected

about an actual exploit attempt using this WP2 shell vulnerability.

We now also got a CVE number for the vulnerability, 2026-630.

The initial advisory didn't include that yet.

And with WordPress extensions, we usually don't get CVE numbers.

But again, this is a vulnerability in WordPress core. And like I mentioned, I set up a vulnerable instance myself,

just going through the standard install instructions of WordPress without loading any special

extensions.

The instance was vulnerable.

So there's nothing you need to configure, enable or such, in order to be vulnerable.

As soon as the rest API is exposed, you are vulnerable.

Now, a couple of things about the exploit attempts that we have seen. They often

use a very obvious user agents, so that would be a first quick fix here to try to filter

these user agents, like the one that I wrote up here, used the actual CVE number as a user agent.

We also have things like WP to Shell Test. That's often... used the actual CVE number as a user agent.

...