WordPress Patches Critical RCE Vulnerability in Latest Update WordPress has released version 7.1.2 to address a critical security flaw (CVE-2026-87902) that could enable unauthenticated remote code execution (RCE) on vulnerable websites under specific conditions. The vulnerability, disclosed by security researcher Robert Ressl, affects WordPress’s page template resolution mechanism, allowing attackers to manipulate template selection and execute arbitrary PHP files outside the intended theme directory. Exploitation does not require authentication, making unpatched sites prime targets for automated scanning and opportunistic attacks. If successfully exploited, the flaw could allow threat actors to deploy web shells, steal database credentials, modify site content, create admin accounts, redirect visitors, or distribute malware. The severity of the issue stems from its potential to fully compromise both the website and underlying server. The vulnerability’s impact depends on server configuration, active theme, and the presence of readable PHP files outside theme directories. While not all WordPress installations are exploitable, the lack of authentication requirements heightens the risk for exposed sites. WordPress has backported the fix to supported legacy branches (down to version 4.7), though only the latest release (7.1.2) receives active support. Administrators are advised to update immediately via the WordPress Dashboard or manual download. Sites with automatic background updates may receive the patch automatically. Post-update, security teams should verify patch installation, review logs for suspicious template-related requests or unauthorized PHP execution, and audit themes or custom code affecting template selection. The flaw underscores the urgency of patching, given its potential for full site and server compromise.

WordPress Patches Critical RCE Flaw in Latest Security Update WordPress released a security update last week addressing 11 vulnerabilities, including a severe flaw dubbed Click2Shell that could enable remote code execution (RCE). The bug, discovered and reported by pwn.ai, allows unauthenticated attackers to exploit specially crafted URLs to install and preview inactive themes without an administrator’s knowledge or consent. The vulnerability arises from a discrepancy in how WordPress’s themes API and JavaScript in an admin’s browser interpret a value in the theme-preview URL. While the API processes it as a standard theme slug, the browser retains the original punctuation, enabling attackers to inject malicious code via a jQuery selector. This forces the installation of an attacker-selected theme from WordPress.org’s official catalog, which despite being inactive can still execute PHP code during a Customizer preview. Pwn.ai identified over 40 third-party themes that could be abused for RCE, as their PHP code loads even when inactive. Exploitation requires only a single visit from a logged-in admin, granting attackers full control over the site. Notably, the attack leaves the primary theme active, making detection difficult. WordPress patched Click2Shell and the other vulnerabilities in version 7.1.1, extending fixes back to WordPress 4.7. Pwn.ai received a $300 bounty the platform’s maximum reward for the discovery. Technical details and a proof-of-concept (PoC) exploit were also published.

TIKTOUK Toolkit Exploits Exposed WordPress Backups to Harvest Cloud and Email Credentials Researchers at LevelBlue have uncovered a large-scale cyberattack campaign leveraging a toolkit called TIKTOUK, which systematically exploits exposed WordPress backups to extract sensitive credentials, including cloud and email access keys. The operation, already active at scale when first detected, combines multiple techniques WordPress probing, configuration file collection, password recovery, and JavaScript scanning to harvest high-value secrets. A leaked control panel revealed that attackers had amassed approximately 50,000 server-side credentials across 37,000 domains, including hundreds of validated AWS keys with potential for abuse in email delivery, computing, and AI services. The toolkit’s modular design includes two Python components and a Go-based Linux crawler, each retrieving tasks from a central HTTP service to coordinate attacks. ### How TIKTOUK Operates 1. WordPress Probing – The toolkit identifies WordPress sites and sends malformed REST batch requests (e.g., combining `DELETE` and `POST` operations) to bypass security controls. When blocked, it retries with multipart encoding, leaving a detectable pattern for defenders. 2. Credential Collection – A separate component targets exposed backups (e.g., `wp-config.php.bak`, `.env`, `.git/config`) to extract database credentials, AWS key pairs, API keys, and SMTP settings. It also decrypts stored email passwords from plugins like WP Mail SMTP and FluentSMTP by leveraging WordPress configuration keys. 3. JavaScript Scanning – The Go-based crawler fetches web pages and referenced scripts, scanning for secrets tied to SendGrid, Anthropic, Bedrock, and AWS. This mirrors past incidents where exposed AWS keys in public JavaScript led to data breaches. ### Impact and Risks The leaked credentials extend beyond the original compromised site, enabling attackers to abuse cloud resources, send malicious emails, or escalate access. Earlier reports on active AWS keys demonstrate how exposed credentials can retain powerful access long after disclosure. LevelBlue linked the toolkit’s request structures to CVE-2026-60137 and CVE-2026-63030, though no successful exploitation in live environments was confirmed. Laboratory tests established component behavior, but researchers did not validate stolen credentials from simulated executions. ### Detection and Indicators of Compromise (IoCs) Defenders are advised to monitor for: - Unusual batch requests with malformed URLs (e.g., `http://:`). - Access to sensitive files (`wp-config.php.bak`, `.env`, `debug.log`). - Communication with TIKTOUK control panels at 193.32.162[.]134, 195.178.110[.]209, and 31.56.58[.]59. - Hashes of malicious components: - WordPress probing: `c6b8d0cdb53da98a5d15e79b7bb9e9f4c272c4f9592acdc291089f126f892f45` - Credential collector: `0d8ea89a63070f68286249aa437aece0e040c1609b8c5c0950ebbc90e6f70f02` - JavaScript scanner: `1e22fde68d83277ed0fe7a8a7b554f0ae118260a2fa143f8e1bdc84c994ebbe90` - Related Go botnet: `9903f4576980ff7cfd560ca57c665a4b59b3c30d` The findings underscore how a single exposed backup can lead to widespread credential theft, with cloud keys and business records becoming accessible through overlooked development materials.

WordPress Patches Critical RCE Vulnerability in Imagick Extension WordPress has released version 7.0.4, a security update addressing a remote code execution (RCE) vulnerability (CVE-2026-65640, GHSA-8vr3-7mxf-gx8w) in sites using the Imagick extension with Ghostscript. The flaw, disclosed by researchers at pwn.ai, allows authenticated Author-level users to execute arbitrary code via crafted file uploads. The vulnerability stems from ImageMagick’s handling of non-image files, such as PostScript, EPS, and PDFs, which it processes using Ghostscript a tool historically prone to exploitation. WordPress’s WP_Image_Editor_Imagick::load() method previously relied on file extensions rather than content inspection, enabling attackers to bypass checks by disguising malicious payloads (e.g., a `.png` file containing PostScript code). Exploitation was possible through alternate upload paths, including XML-RPC’s `wp.uploadFile` and MP3 cover-art extraction, which skipped WordPress’s `wp_check_filetype_and_ext()` validation. The patch (commit 7daaa50) now scans file headers to block PostScript, EPS, fake PDFs, and compressed formats, while also stripping format specifiers (e.g., `EPS:innocent.png`) that could force unsafe decoding. While the flaw requires Author-level access, sites with multi-author or open contributor models face heightened risk. WordPress has backported fixes to the 4.7 branch and the upcoming 7.1 RC3, though only the latest version receives full support. Administrators are advised to update immediately, particularly on sites with broad upload privileges.

Chinese-Speaking Threat Actor Exploits Critical WordPress Vulnerabilities in Global Cyber Espionage Campaign A suspected Chinese-speaking threat actor has leveraged a critical WordPress vulnerability chain, dubbed wp2shell, to compromise government and small-business targets across 29 countries, stealing at least 18,566 sensitive records from a Western government organization. The campaign, tracked by GreyNoise since early June, exploits two zero-day flaws CVE-2026-63030 (a route-confusion flaw in the WordPress REST API batch endpoint) and CVE-2026-60137 (a SQL injection vulnerability in WP_Query’s author__not_in parameter) to achieve unauthenticated remote code execution (RCE) on vulnerable WordPress deployments. The vulnerabilities affect WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2, with patches released in the latest updates. Both CVEs were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on July 21 after confirmed active exploitation. ### Attack Scope and Impact GreyNoise observed the actor successfully breach 49 organizations, including government entities in Germany, Colombia, Switzerland, Brazil, Japan, the UK, India, the US, and Ukraine, as well as a Russian state entity in occupied Ukraine. The most severe incident targeted a Western government organization on July 22, where the attacker: - Exploited the WordPress flaws to deploy a custom web shell within 11 minutes. - Dumped the WordPress user table, stealing 13 administrator accounts. - Created a fraudulent admin account with a backdated 2025 registration timestamp to evade detection. - Uploaded a custom WordPress plugin for host enumeration, then scanned Microsoft Defender settings, local users, services, MySQL, IIS sites, and registry keys. - Used 17 script variants to evade detection, test privilege escalation, and hunt for credentials in readable files. - Harvested database credentials from configuration files, staged stolen data in a ZIP archive, and exfiltrated it via a web-accessible directory. - Conducted password spraying against internal resources, accessing an SQL database and extracting 18,566 records containing accounts, plaintext passwords, and PII tied to law enforcement and government agencies. ### Attribution and Broader Campaign GreyNoise links the activity to “Red Heron”, a threat group previously documented by Acronis, citing overlaps in C2 infrastructure, malware, Gitea exploitation, and tradecraft. The actor has also targeted: - Ubiquiti UniFi OS - FlowiseAI - Gitea - Nuclio - SENAITE LIMS - Proxmox VE - PAN-OS GlobalProtect - ZyXEL GS1900 switches (exploiting CVE-2026-7273 to steal device configurations, hashed root credentials, and network data from 996 switches across 48 countries the first documented in-the-wild exploitation of this flaw). ### Technical Details The attack chain relies on Chinese-language comments in the malicious code, with rapid script iterations suggesting possible LLM-assisted tooling development. Indicators of compromise (IOCs) include: - Backdoors: `0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f`, `0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6` - C2 Domains/IPs: `*.981666[.]xyz`, `74.48.66.73`, `104.225.153.141` Organizations are advised to upgrade to patched WordPress versions and monitor for unauthorized admin accounts, suspicious plugins, modified web-root files, and unusual access to `/wp-json/batch/v1`. The campaign underscores the risks of unpatched WordPress instances connected to internal databases and Windows servers.

CISA Warns of Actively Exploited WordPress Core SQL Injection Flaw The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-60137, a critical SQL injection vulnerability in WordPress Core, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in real-world attacks. The flaw stems from improper input validation in database queries, allowing attackers to manipulate SQL statements particularly when themes or plugins fail to sanitize untrusted data. The vulnerability poses a severe risk, especially for internet-facing WordPress instances, as it can be chained with CVE-2026-63030 an interpretation conflict flaw in WordPress Core to achieve unauthenticated remote code execution (RCE) on default installations. This combination enables attackers to escalate attacks beyond data theft, potentially compromising entire systems. CISA designated both vulnerabilities as high-priority threats, adding them to the KEV catalog on July 21, 2026. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies must apply patches or mitigations by August 4, 2026. The agency urges all organizations to assess exposure, prioritize internet-facing systems, and follow vendor guidance including temporary mitigations or service suspensions if patches are unavailable. WordPress’s widespread use across enterprises, government, and small businesses makes these flaws particularly concerning. Threat actors frequently target the platform due to its plugin ecosystem and common misconfigurations, which expand attack surfaces. Automated scanning tools are already being used to identify vulnerable installations, with attackers leveraging SQL injection to extract data or prepare for further exploitation. Security researchers emphasize the need for immediate updates to patched WordPress versions, audits of plugins/themes for secure coding practices, and the deployment of web application firewalls (WAFs) to block malicious input. Database query logging and behavioral monitoring can also aid in detecting exploitation attempts. The inclusion of CVE-2026-60137 in CISA’s KEV catalog underscores its urgency, as confirmed attacks highlight the growing threat to web infrastructure.

Critical "wp2shell" RCE Vulnerability in WordPress Core Exposes 500M+ Sites to Takeover A severe pre-authentication remote code execution (RCE) flaw, dubbed wp2shell, has been discovered in WordPress Core, leaving over 500 million websites vulnerable to full compromise by unauthenticated attackers. Security researcher Adam Kues of Searchlight Cyber’s Assetnote team identified the bug, which stems from a REST API batch-route confusion issue leading to SQL injection and, ultimately, RCE. The vulnerability is particularly dangerous because it requires no prior access, plugins, or special configurations only a reachable WordPress instance running an affected version. Exploiting it allows attackers to execute arbitrary code without authentication, making it a zero-click threat. Affected Versions & Patches The flaw impacts WordPress versions 6.9.0–6.9.4, 7.0.0–7.0.1, and 7.1 beta (pre-release). Two CVEs track the issue: - CVE-2026-60137 (SQL injection, also affecting WordPress 6.8.x before 6.8.6) - CVE-2026-63030 (batch-route RCE, reported by Kues) WordPress has released 7.0.2, 6.9.5, and 6.8.6 to address both flaws, with auto-updates force-pushed to affected sites due to the severity. Manual updates are also available via the WordPress Dashboard or direct download. Mitigation & Workarounds While patching is strongly recommended, temporary measures include: - Blocking anonymous REST API access via plugin. - Restricting access to `/wp-json/batch/v1` and `?rest_route=/batch/v1` endpoints at the WAF level. The WordPress security team credited researchers TF1T, dtro, and haongo for the SQL injection discovery, alongside Kues for the RCE chain. Technical exploit details remain undisclosed to prevent immediate exploitation.

Estonia Sees Record Surge in Data Breach Notifications in Q3 2026 Estonia’s data protection regulator reported a sharp rise in data breach notifications during the third quarter of 2026, receiving a record 123 reports a 116% increase compared to the same period in 2025. The surge was driven in part by exploited vulnerabilities in widely used platforms, including Magento and WordPress, as well as a significant data leak at a dental software provider. Of the reported incidents, 25 involved public sector organizations, highlighting broader cybersecurity challenges across both private and government entities. The regulator’s findings underscore the growing threat landscape and the need for heightened vigilance in securing digital infrastructure. The statement was released on October 8, 2026.

Outdated PHP Versions Leave Majority of WordPress Sites Vulnerable to Attacks A recent analysis by Censys has uncovered a critical security gap in the global web ecosystem, revealing that over 70% of publicly accessible WordPress sites are running outdated, end-of-life (EOL) PHP versions. As of June 2026, WordPress powers more than 40% of all websites over 59 million instances making this a widespread and systemic issue. The research examined 316,500 WordPress deployments with visible version data and found that only 30% were using supported PHP versions. The majority relied on deprecated releases, including PHP 7.4, which reached EOL in November 2022. While WordPress core updates were more frequently applied with 31% of sites running supported versions (6.9 or higher) and 14% on the latest release (7.0) the underlying PHP runtime remained neglected, creating a significant security blind spot. Outdated PHP versions expose sites to unpatched vulnerabilities, lack of security support, and compatibility issues with modern defenses. Since PHP underpins WordPress themes and plugins, weaknesses at this level can compromise the entire application stack. Attackers are actively exploiting this gap, targeting legacy environments that are easier to breach at scale. Operational challenges contribute to the problem, as site owners often delay upgrades due to concerns about breaking functionality, plugin incompatibilities, and complex migration paths. The issue is further exacerbated by inconsistent plugin patching less than 22% of Yoast SEO users, for example, run the latest version. Plugins introduce additional risks, with high-profile tools like UpdraftPlus facing multiple critical vulnerabilities, including authentication bypass and data exposure flaws. Real-world consequences are evident in ongoing attack campaigns, such as the "Hacked By MR.GREEN" defacement operation, which has compromised over 900 WordPress sites since 2020. These attacks exploit outdated software, misconfigurations, and exposed endpoints like xmlrpc.php, with continuous scanning activity targeting vulnerable sites. While the campaign focuses on defacement rather than financial gain, it demonstrates how low-sophistication threats can achieve widespread impact when basic security hygiene is ignored. The findings underscore the need for organizations to address both application and infrastructure layers, ensuring regular PHP updates, proactive plugin management, and secure configurations to reduce exposure.

Critical RCE Vulnerability in Everest Forms Pro Plugin Exploited in the Wild Hackers are actively exploiting a severe remote code execution (RCE) vulnerability in the Everest Forms Pro WordPress plugin, tracked as CVE-2026-3300 (CVSS 9.8). The flaw, affecting all versions up to 1.9.12, allows unauthenticated attackers to execute arbitrary PHP code on vulnerable websites by manipulating form inputs. The vulnerability stems from the plugin’s "Complex Calculation" feature, where the `process_filter()` function dynamically constructs and evaluates PHP code using `eval()`. Despite input sanitization via `sanitize_text_field()`, the function fails to escape single quotes, enabling attackers to inject malicious payloads through standard form fields (text, email, URL, select, radio). By appending a single quote followed by arbitrary PHP code, threat actors can bypass security controls and gain server-side execution. Publicly disclosed on March 30, 2026, after a patch was released on March 18, 2026, the flaw saw active exploitation beginning April 13, 2026. Wordfence reported blocking over 29,300 exploitation attempts, with a sharp spike of 17,900 attacks on May 16 alone. Attackers primarily exploit the `/wp-admin/admin-ajax.php` endpoint via crafted POST requests, targeting websites with the Complex Calculation feature enabled. Observed attack patterns include the creation of rogue administrator accounts, such as the username "diksimarina", using WordPress’s `wp_insert_user()` function. Once administrative access is obtained, attackers deploy webshells, backdoors, or further compromise the hosting environment. Multiple malicious IPs have been identified, including: - 202.56.2[.]126 (tens of thousands of blocked requests) - 209.146.60[.]26 (thousands of exploit attempts) - 15.235.166[.]18 (hundreds of malicious requests) - 2402:1f00:8000[:]800::40db (IPv6-based attacks) - 185.78.165[.]153 (hostile scanning activity) While Wordfence provided early protection via firewall rules (February 27 for paid users, March 29 for free users), full mitigation requires updating to version 1.9.13. Indicators of compromise include unauthorized admin accounts and suspicious requests from known malicious IPs. The low barrier to exploitation and active campaign make this a high-impact threat to WordPress environments.

High-Severity SQL Injection Flaw in Ally WordPress Plugin Exposed 246,600 Sites A critical SQL injection vulnerability (CVE-2026-2413) in the Ally WordPress plugin a web accessibility tool from Elementor left approximately 246,600 websites vulnerable to data theft. The flaw, discovered by security researcher Drew Webber of Acquia, allowed unauthenticated attackers to inject malicious SQL queries into databases, enabling the extraction of sensitive information via time-based blind SQL injection techniques. The vulnerability, rated 7.5/10 (high severity), affected all versions of Ally up to 4.0.3. It was patched on February 23 with the release of version 4.1.0. Despite over 400,000 active installations, only 38.4% (153,600 sites) had updated to the secure version at the time of disclosure, leaving the majority exposed. WordPress, which has long emphasized the security risks posed by third-party plugins, urged users to immediately update both Ally and the core platform. WordPress 6.9.2, released recently, addressed 10 vulnerabilities, including XSS, authorization bypass, and SSRF flaws. The incident underscores the persistent threat of plugin-based vulnerabilities in the WordPress ecosystem, where outdated or unsupported extensions remain a primary attack vector.

High-Severity WordPress Vulnerability Enables Remote Code Execution via Malicious Comments A critical vulnerability in WordPress, tracked as CVE-2026-93485 (CVSS 7.1), allows unauthenticated attackers to execute server-side commands by exploiting a stored cross-site scripting (XSS) flaw in the platform’s `wpautop()` formatting function. The issue was patched in WordPress 7.1.1, with fixes backported to versions as early as 4.7.36. The flaw, demonstrated by the Comment2Shell proof-of-concept, enables attackers to embed malicious payloads in seemingly harmless comments. By crafting a newline within the `cite` attribute of a `blockquote` element, the exploit bypasses initial sanitization via WordPress’s KSES filter. During rendering, `wpautop()` incorrectly processes the payload, injecting attacker-controlled `onfocus` and `autofocus` attributes that trigger JavaScript execution when viewed. If an administrator loads the infected post, the XSS payload gains privileged access, allowing it to: - Retrieve the plugin-installation nonce - Construct and upload a webshell disguised as a plugin - Execute arbitrary commands before self-deleting to minimize detection Exploitation requires comments to be enabled, anonymous submissions allowed, and the malicious comment to be visible (e.g., auto-approved or manually published). While block themes are most vulnerable, classic themes may also be affected under certain conditions. Comment moderation can mitigate immediate risks but should not be relied upon as a security control. The vulnerability affects WordPress versions 4.7 through 7.1.0, with patches available for all supported branches. Rafie Muhammad of Awesome Motive reported the underlying issue, while the Comment2Shell project provides tools for detection, including a Python scanner, Nuclei template, and IOC checker. Though no active exploitation was reported at disclosure, the public proof-of-concept lowers the barrier for attacks. Defenders are advised to: - Upgrade to WordPress 7.1.1 or the latest patched version - Audit `wp_comments` for suspicious `blockquote`, `cite`, `onfocus`, or `autofocus` entries - Monitor `wp-comments-post.php` and `wp-admin/update.php` for unusual activity - Inspect `wp-content/plugins` for unauthorized PHP files Temporary mitigation includes disabling comments until patches are applied. Organizations should treat unexpected plugin uploads or comment anomalies as potential compromise indicators.

Critical libheif Vulnerability Enables Remote Code Execution in WordPress A severe heap-buffer-overflow flaw in libheif, tracked as GHSA-x8r2-mggj-j6wr, allows authenticated WordPress users to achieve remote code execution (RCE) by uploading a maliciously crafted HEIC image via the Media Library. The vulnerability affects the library’s uncompressed-image (unci) decoder and was patched in libheif 1.23.3. ### How the Exploit Works The flaw resides in libheif’s mixed-interleave YCbCr decoding path, where a malicious HEIC file can declare the Cb chroma component as 16-bit while the Cr component remains 8-bit. Despite allocating only one byte per sample for the Cr plane, the vulnerable code writes both chroma channels using the Cb’s two-byte width, leading to a file-controlled out-of-bounds write and heap corruption. Researchers at Fortbridge demonstrated that this memory corruption can be chained into authenticated RCE in specific WordPress environments: - Ubuntu 26.04 (WordPress 7.1.1, PHP-FPM 8.5.4, ImageMagick 7.1.2.18, libheif 1.21.2) - Debian 13 (WordPress 7.0, PHP-FPM 8.4.24, ImageMagick 7.1.1.43, libheif 1.19.8) In lab tests, the exploit succeeded in 6 of 8 Ubuntu runs and 22 of 24 Debian runs, executing commands as the www-data PHP-FPM account after an Author-level user uploaded the malicious HEIC file. ### Exploit Chain & Requirements The attack requires: - An authenticated WordPress user with upload_files capability (typically Author or higher). - PHP’s Imagick extension and ImageMagick processing the uploaded HEIC file, passing it to libheif for decoding. - No single malicious upload instead, the exploit first leaks memory addresses via WordPress-generated image derivatives (e.g., JPEG thumbnails), then crafts an ASLR-adjusted payload based on the target’s environment. The memory disclosure relies on a separate libheif flaw (GHSA-2jg2-4ch7-h545), patched in libheif 1.23.2, which involves out-of-bounds reads/writes in derived-image handling. ### Mitigation & Patching - Upgrade libheif to 1.23.3 or later (API/ABI-compatible with 1.23.2). - Debian released a security update (1.23.4-1~deb13u1) addressing multiple libheif vulnerabilities. - Restart PHP-FPM after patching to clear vulnerable library instances from memory. - Disable HEIC/AVIF uploads if not required. - Isolate image processing in a least-privileged service with restricted access. - Monitor for PHP-FPM worker crashes or HTTP 503 errors during image uploads, which may indicate exploitation attempts. The vulnerability highlights how native-code dependencies in image-processing stacks can expose web applications to unexpected attack surfaces, even in hardened WordPress environments.

Russian Threat Actor Exploits Jailbroken Google Gemini in Multi-Year AI-Assisted Fraud Campaign A Russian-speaking threat actor, tracked as bandcampro, leveraged a jailbroken instance of Google Gemini to orchestrate a sophisticated, AI-driven fraud and credential theft operation active since 2021. The campaign targeted politically engaged audiences, particularly those aligned with QAnon and MAGA movements, through a Telegram channel (@americanpatriotus) impersonating a U.S. military veteran. By 2024, the channel had amassed 17,000 subscribers. The attacker used the compromised AI model to crack WordPress administrator credentials, enabling access to backend systems where persistent credentials were stored. These stolen credentials were then exploited to drain at least one victim’s cryptocurrency wallet, demonstrating the high-impact risks of unsecured legacy data storage. The operation was executed at near-zero cost, relying on stolen API keys and AI-driven automation to scale attacks. The incident highlights a critical shift in the threat landscape: offensive AI tools are now fast, cheap, and accessible, rendering traditional perimeter defenses ineffective. The breach underscores the vulnerability of static credential storage where sensitive data remains exposed long after initial access rather than just the jailbreak itself. Experts warn that without transitioning to zero-persistence architectures, where sensitive data exists only in volatile memory for brief transaction windows, such attacks will continue to pose existential risks to enterprises. The case also reveals how AI lowers the barrier for threat actors, enabling large-scale influence operations, phishing, and credential theft with minimal technical expertise. The actor’s infrastructure, uncovered in early 2024, serves as a stark example of how AI-assisted cybercrime is evolving beyond traditional hacking into low-cost, high-impact campaigns.