WordPress customize_changeset publish with forged remembered user (wp2shell)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•1•0•6

Detects instances where a WordPress customization changeset is published by a session user that differs from the user associated with the changeset, specifically when the changeset owner holds an administrator role. This behavior may indicate account hijacking or unauthorized privilege escalation within the WordPress administration interface.