SecurityThe Hacker Newsabout 2 hours ago
WordPress Core Flaw Allows Unauthenticated Code Execution
1 min read
A pre-auth RCE vulnerability in WordPress core, named wp2shell, lets anonymous attackers run code on default installs with no plugins. WordPress shipped versions 6.9.5 and 7.0.2 on July 17, 2026, closing the flaw. Adam Kues at Assetnote discovered the bug and reported it through HackerOne.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
