WordPress XSS2Shell Flaw Lets Unauthenticated Attackers Gain Remote Code Execution

Building upon a technique disclosed by researcher Paulos Yibelo in 2022, pwn.ai leverages an admin session to mint a WordPress Application Password. By publishing a page with attacker JavaScript through the unfiltered_html capability and subsequently uploading a plugin ZIP containing a PHP web shell via legitimate, authenticated API calls, the chain exploits conditions outside of the attacker's control and requires successful social engineering combined with explicit victim interaction. Mitigation Site owners should update WordPress to version 7.0.3 immediately; installations with automatic background updates have likely already received it.