New wp2shell WordPress Core Flaw Allows Unauthenticated Code Execution
A newly discovered vulnerability termed 'wp2shell' in the WordPress core allows unauthenticated attackers to run arbitrary code through a simple HTTP request. This critical issue affected WordPress versions 6.9 and 7.0 but was recently addressed with the release of versions 6.9.5 and 7.0.2, which also rolled out forced auto-updates.
What happened
Security researcher Adam Kues from Assetnote, a division of Searchlight Cyber, identified and reported a serious flaw in the WordPress core platform. The vulnerability enables any unauthenticated attacker to execute arbitrary code on affected WordPress sites simply by sending an HTTP request. Notably, the flaw exists in the core WordPress code, making it exploitable even on clean installations without any plugins or modifications.
This vulnerability affected all WordPress sites running versions 6.9 and 7.0. Following the discovery and responsible disclosure, WordPress released patched versions 6.9.5 and 7.0.2 to address the issue and activated forced auto-updates through their update system to mitigate ongoing risks.
Why it matters
WordPress powers a significant portion of the internet’s websites, making vulnerabilities in its core a major security concern for a large ecosystem of site owners and administrators. Because this flaw allows remote unauthenticated code execution on vulnerable sites, exploitation could lead to full site compromise, data breaches, or use of the affected infrastructure for further attacks.
The fact that the flaw resides in core code — not in optional plugins or themes — increases the urgency of patching, as even minimal default setups were at risk. Automated updates improve protection by reducing the window during which sites remain vulnerable to exploitation after patches are published.
What security teams should do
Site administrators should ensure their WordPress installations are updated to version 6.9.5, 7.0.2, or later as soon as possible. Given the availability of forced auto-update, verifying that updates have been applied correctly is a key first step.
Additionally, operators should review their logs for unusual or unauthenticated HTTP requests that might indicate attempted exploitation. As this vulnerability affects the core software, no plugin-specific mitigations are applicable; therefore, applying the official patch remains the primary defense.
Key technical details
The vulnerability enables an anonymous HTTP request to execute arbitrary code on the WordPress site. While the specific code path or root cause has not been detailed, the research indicates that no plugins or additional components need to be installed for exploitability, as the flaw is inherent to the WordPress core.
The affected versions include all releases in the 6.9 and 7.0 branches prior to the patched versions 6.9.5 and 7.0.2. The patches were deployed with forced updates activated to facilitate rapid remediation across the ecosystem.
Affected organizations/products
All WordPress sites running versions 6.9 and 7.0 prior to the patched releases 6.9.5 and 7.0.2 were vulnerable. This includes minimal installations without any plugins or customizations.
Source attribution
https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html
