New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

Home / Tech / New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

July 17, 2026 dirk 0 Comments 3 tags

New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable.

Every 6.9 and 7.0 site was in range until Friday, when WordPress shipped 6.9.5 and 7.0.2 and enabled what it calls forced updates through its auto-update system.

Adam Kues at Assetnote, Searchlight Cyber’s attack surface management arm, found the flaw and reported

Source: The Hacker News

Explore More

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six

The case against geometric algebra (2024)

The case against geometric algebra (2024) Source: Hacker News

OpenAI’s New Device Will Be Hockey Puck-Sized and Cost over $300

OpenAI’s New Device Will Be Hockey Puck-Sized and Cost over $300 Source: Hacker News