Swati KhandelwalJul 17, 2026Vulnerability / Web Security
An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable.
Every 6.9 and 7.0 site was in range until Friday, when WordPress shipped 6.9.5 and 7.0.2 and enabled what it calls forced updates through its auto-update system.
Adam Kues at Assetnote, Searchlight Cyber's attack surface management arm, found the flaw and reported it through WordPress's HackerOne program. The writeup, published under the name wp2shell, says the attack has "no preconditions and can be exploited by an anonymous user."
The firm is sitting on the technical details for now and has put up a checker at wp2shell.com instead, so owners can test their own instance.
