This New WordPress Core Flaw Lets Attackers Run Code on Any Site

Emily Davis · 2026-07-17

If you run a WordPress site, you need to know about a serious security flaw that just hit the headlines. It's not a plugin issue or a theme vulnerability—this one lives in the core of WordPress itself. That means even a bare-bones install with zero plugins is wide open to attack. ### The Flaw in Plain English Here's the scary part: an anonymous HTTP request can run code on your WordPress site. No authentication needed. No special permissions. Just a simple request, and an attacker can execute commands on your server. This is as bad as it sounds. Adam Kues from Assetnote, which is part of Searchlight Cyber's attack surface management team, discovered the bug and reported it responsibly. The flaw affects every WordPress site running version 6.9 or 7.0. That's millions of sites worldwide. ### How WordPress Responded Until Friday, every 6.9 and 7.0 site was vulnerable. That's when WordPress shipped emergency updates: versions 6.9.5 and 7.0.2. They didn't just release the patches and hope for the best—they enabled what they call "forced updates" through the auto-update system. That means if you have auto-updates turned on (and you should), your site got patched automatically. But here's the thing: not every site has auto-updates enabled. And even if yours does, the forced update mechanism isn't perfect. Some hosting environments block it. Some configurations override it. So you can't just assume you're safe. ### What You Need to Do Right Now First, check your WordPress version. If you're on 6.9.x, you need version 6.9.5. If you're on 7.0.x, you need 7.0.2. If you're on an older version, you're likely vulnerable too, but you should update to the latest branch anyway. - Log into your WordPress admin panel - Go to Dashboard > Updates - If an update is available, install it immediately - Verify the update by checking your site health ### Why This Matters for Antidetect Browser Users You might be wondering what this has to do with antidetect browsers. Here's the connection: if you manage multiple online profiles or accounts, you're likely using antidetect browsers to keep them separate. But if your WordPress site is compromised, all that effort goes out the window. An attacker who gains access to your server can steal cookies, session data, and even fingerprint profiles stored on your site. This is why digital privacy isn't just about the tools you use—it's about the infrastructure you build on. A single vulnerability in your website's core can undo all the privacy work you've done. ### The Bigger Picture This flaw is a reminder that no software is perfect. Even WordPress, which powers over 40% of the web, has critical bugs. The key is how quickly you respond. The team at WordPress did a great job getting a patch out fast. But the responsibility to apply it falls on you. If you're running a business or managing client sites, make sure you have a process for monitoring security updates. Set up automated notifications. Use a security plugin that alerts you to critical updates. And for heaven's sake, turn on auto-updates. ### Final Thoughts This isn't a drill. The wp2shell flaw is real, and it's dangerous. But it's also a wake-up call. Take five minutes today to check your WordPress version. Update if you need to. Then think about your overall security posture—from the antidetect browser you use to the hosting environment your site lives on. Stay safe out there. The internet is a wild place, and we all need to look out for each other.