Aren’t WP exploits valuable for watering hole attacks?

strictnein · 2026-07-20T20:09:21 1784578161

You don't need an RCE for that though. There's a lot of vulnerable plugins deployed everywhere.

dcrazy · 2026-07-20T21:54:02 1784584442

Ok, but an RCE in WP Core still seems pretty dang valuable, especially if you want to hit non-commercial websites that are less likely to have as many plugins installed?

illliillll · 2026-07-20T20:48:15 1784580495

You already owned the WordPress admin with your browser 0day, you don’t care if WordPress is secure or not.