WordPress Forged customize_changeset Post Escalates via wp_set_current_user

Duo Tech@duotech

•updated Jul 23, 2026•0•0•3

Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.