Yoeri Vegt's blog
Wordpress Core unauthenticated RCE A technical walkthrough of the wp2shell chain, where two small bugs in the WordPress REST API turn into unauthenticated remote code execution on a default install. Original discovery by Adam Kues and Patrik Grobshäuser at Assetnote. The proof of concept discussed here was built with Claude.
July 18, 2026
This blog details a flaw in Ada Support’s iframe allowlist where an unclaimed domain was still trusted. Attackers could register it, embed the real support chat, steal OAuth tokens and transcripts, and fully compromise sessions. It stresses monitoring allowlist domains to prevent such risks.
August 27, 2025
Discover hidden domains for bug bounty targets by analyzing NS records and using an API to lookup matching domains.
November 24, 2024