Reported by 5 outlets
TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.56 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
TIKTOUK is a hub-and-worker credential harvester for WordPress hosting, built from three parts: the Python scripts wp2s_poll.py and wp2s_crack.py and a stripped Go crawler named jscrawl-amd64. Each worker pulls target lists from a central HTTP hub, runs its collection task, and reports back to /v1/ingest or /api/crack/report. The poller probes REST batch routes with a malformed http://: path carrying DELETE /wp/v2/categories/0 and POST /wp/v2/block-renderer/core/paragraph, retrying in multipart encoding after a JSON 403. The collector fetches wp-config.php.bak, .env, .git/config, backup.sql and wp-content/debug.log, then decrypts stored mail credentials for WP Mail SMTP, Easy WP SMTP and FluentSMTP using the plugins' own key material, while the crawler sweeps site JavaScript for SendGrid, Anthropic, Bedrock and AWS-shaped tokens. LevelBlue SpiderLabs published the analysis on October 1, 2026; the two CVEs the story attaches, CVE-2026-60137 and CVE-2026-63030, were fixed by WordPress on July 17, 2026 in 6.8.6, 6.9.5 and 7.0.2.
The CVE linkage is the weakest part of the story framing. LevelBlue never demonstrated exploitation of either bug; the target simulator returned prepared responses, and the record shows the SQL injection (CVE-2026-60137, CVSS 5.9) and the batch-route confusion that turns it into RCE (CVE-2026-63030, CVSS 9.8) as context for the toolkit's request structures, not a proven kill chain. The collection path needs no unpatched WordPress at all, only exposed backup and configuration files and secrets nobody rotated, so it works against fully patched sites. What makes this story matter is scale and end state: the leaked TIKTOUK panel LevelBlue examined held roughly 50k server-side credentials across about 37k domains, including hundreds of actor-validated live AWS keys, and the collector derives an SES SMTP password from a stolen AWS secret. The victim's outcome is not defacement but someone else's spam, compute and model inference billed to their cloud account. CISA listing both CVEs on July 21 with a four-day federal remediation deadline confirms the RCE door is already being knocked on.
Defenders should patch to 7.0.2 or 6.9.5, or 6.8.6 on the 6.8 line, and treat KEV presence as evidence of active exploitation. Deny web access to the exact file set the collector pulls: wp-config.php.bak, .env, .git/config, backup.sql and wp-content/debug.log. Rotate SMTP and AWS credentials found in any exposed dump and audit AWS accounts for keys created around the compromise window. The specific hunt: REST batch requests containing http://: with nested author_exclude or UNION ALL SELECT, especially a JSON 403 followed by a multipart 200 to the same route, correlated with same-host fetches of the exposed-file set and submissions to /v1/ingest or /api/crack/report. Match hosts against the LevelBlue sample hashes for the three components and watch for traffic to 31.56.58.59, 193.32.162.134 and 195.178.110.209.
Two developments would change the assessment. Confirmed in-the-wild chaining of the batch-route confusion would move TIKTOUK from a hygiene threat to an active unauthenticated RCE campaign against default WordPress. Infrastructure churn is the other signal: LevelBlue is tracking additional panels and a related Go botnet binary with remote command execution capability (SHA1 9903f4576980ff7cfd560ca57c665a4b59b3c30d), so new panel addresses or a takedown of the known ones would show the operator reacting and possibly retooling.
Timeline
-
original reporting
TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks
gbhackers.com · 11d ago · October 2nd, 2026
A credential-collection toolkit dubbed TIKTOUK that combines WordPress reconnaissance, exposed-file harvesting, plugin credential decryption, and JavaScript secret scanning. The toolkit consists of two Python scripts, wp2s_poll.py and wp2s_crack.py, alongside a stripped Go-based Linux crawler named jscrawl-amd64. All three components retrieve targets from a central HTTP hub, execute assigned collection tasks, and submit status reports and […] The post TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from wordpress.org
WordPress 7.0.2 Release (Security Release)
wordpress.org · 88d ago · July 17th, 2026
The WordPress security team shipped fixes for a facilitated SQL injection reported by TF1T, dtro, and haongo, and for a REST API batch-route confusion plus SQL injection leading to Remote Code Execution reported by Adam Kues at Assetnote / Searchlight Cyber. Backports fixed both issues in 6.9.5 and the SQL injection alone in 6.8.6; the 7.1 beta also received the fixes in beta2. Versions prior to WordPress 6.8 are not affected.
-
update from nvd.nist.gov
CVE-2026-60137: WordPress WP_Query author__not_in SQL Injection
nvd.nist.gov · 88d ago · July 17th, 2026
NVD published the record for insufficient sanitization of the author__not_in parameter in WP_Query, allowing SQL injection when a plugin or theme passes untrusted input to it. Base score is 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
-
update from nvd.nist.gov
CVE-2026-63030: WordPress REST API batch endpoint route confusion to RCE
nvd.nist.gov · 88d ago · July 17th, 2026
NVD published the record for a REST API batch endpoint route confusion issue that, combined with the author__not_in SQL injection (CVE-2026-60137), can achieve Remote Code Execution. Base score is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
-
update from cisa.gov
CISA KEV catalog entries for CVE-2026-60137 and CVE-2026-63030
cisa.gov · 85d ago · July 21st, 2026
CISA added both WordPress vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-07-21, four days after the fixes shipped. The batch-route RCE chain carried a remediation due date of 2026-07-24 and the SQL injection 2026-08-04, reflecting confirmed exploitation rather than theoretical risk.
-
update from levelblue.com
TIKTouk: Tracing a WordPress Credential Collection Toolkit (LevelBlue SpiderLabs)
levelblue.com · 12d ago · October 1st, 2026
SpiderLabs researcher Maor Gabay published the original analysis of TIKTouk a day before the story's first coverage, including real-world incident telemetry: a victim host pulled payloads from and reported to controller 31.56[.]58.59, with additional panels at 193.32.162[.]134 and 195.178.110[.]209. A leaked TIKTouk panel examined by analyst Leon Cottrell held roughly 50k server-side credentials across about 37k domains, including hundreds of actor-validated live AWS keys with SES/EC2/Bedrock abuse potential. The post also lists SHA-256 hashes for wp2s_poll.py, wp2s_crack.py, and jscrawl-amd64, and a related Golang botnet binary with remote command execution.
-
update from www.levelblue.com
(levelblue.com) TIKTOUK: A Comprehensive Analysis of a WordPress Credential Collection Toolkit In brief - This article analyzes TIKTOUK, a s
www.levelblue.com · 11d ago · October 2nd, 2026
(levelblue.com) TIKTOUK: A Comprehensive Analysis of a WordPress Credential Collection Toolkit In brief - This article analyzes TIKTOUK, a s
via Mastodon https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit