References https://s4e.io/tools/wordpress-exposed-installation-page-exposure-scanner https://medium.com/@srilakivarma/%EF%B8%8F-%EF%B8%8F-how-i-hacked-a-wordpress-setup-and-gain-admin-privilege-and-got-paid-for-it-98a49433519f https://github.com/georgknabl/wordpress-installation-attack https://www.exploit-db.com/exploits/18417 https://developer.wordpress.org/advanced-administration/before-install/howto-install/ https://github.com/Ostorlab/KEV https://www.upguard.com/blog/wordpress-risks
Related VulnerabilitiesPoCCVE-2026-87902: WordPress Core - PHP Template Path TraversalPoCCVE-2026-80099: Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC SecretPoCCVE-2026-84434: WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File UploadPoCwordpress-click2shell: WordPress Click2Shell Theme Preview Selector InjectionPoCapache-livy-logs: Apache Livy - Logs ExposedWordpress Events Calendar插件敏感信息泄露漏洞(CVE-2025-9808)WordPress Directory Kit 插件敏感信息泄露漏洞(CVE-2025-13920)PoCCVE-2025-14998: Branda WordPress plugin - Privilege EscalationPoCCVE-2022-1281: Photo Gallery WordPress v1.6.3 - SQL InjectionPoCCVE-2026-12394: WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege EscalationPoCds-store-file: DS_Store File - ExposedPoCsimple-file-list-rce: WordPress Simple File List <=4.2.2 - Remote Code ExecutionPoCCVE-2026-13147: WordPress Kirki < 6.0.12 - Server-Side Request Forgery