A critical WordPress core vulnerability lets unauthenticated attackers run code on any 6.9 or 7.0 site, even with zero plugins. Update immediately to protect your site.
You might think your WordPress site is safe because you don't use any plugins. But a newly discovered vulnerability in WordPress core itself proves that assumption is dangerously wrong.
Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it.
An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable. Every 6.9 and 7.0 site was in range until the patch was released. That's millions of websites, from small blogs to enterprise portals, all sitting ducks until they updated.
### What Makes This Flaw So Dangerous
This isn't your typical plugin vulnerability that requires a specific combination of add-ons to work. The wp2shell flaw targets the core WordPress codebase, meaning even a fresh installation with no customizations is vulnerable. Attackers don't need any special privileges or authentication. Just a single HTTP request sent to your site's URL can trigger the exploit.
Here's what makes it particularly alarming:
- No authentication required: anyone with internet access can attempt an attack
- Works on default installations: no plugins or themes needed
- Remote code execution: attackers can run arbitrary commands on your server
- Wide impact: every WordPress 6.9 and 7.0 site was affected
### How Attackers Exploit the Vulnerability
The flaw lies in how WordPress handles certain HTTP requests related to object caching. When a persistent object cache is enabled, the vulnerability becomes even easier to exploit. Attackers craft a special request that tricks WordPress into executing malicious code stored in the cache.
Think of it like this: your WordPress site has a memory system. Normally, it only stores safe information. But this bug lets attackers slip dangerous instructions into that memory, and when your site retrieves them, it runs the code without realizing it's hostile.
### The Timeline of Discovery and Response
The security researchers who found this flaw followed responsible disclosure practices. They notified the WordPress core team before making any details public. Here's how it played out:
1. Initial discovery and private disclosure to WordPress security team
2. Development of a patch by the core contributors
3. Public release of the fix in WordPress 7.0.1 and 6.9.3
4. Assignment of CVE identifiers for both related flaws
5. Publication of the full technical mechanism by researchers
6. Release of a working proof-of-concept exploit code
Once the proof-of-concept went public, the race was on. Site owners who hadn't updated yet became immediate targets.
### What You Need to Do Right Now
If you're running a WordPress site, here's your action plan:
- Update immediately: make sure you're on WordPress 7.0.1 or 6.9.3 or later
- Check your version: go to your dashboard and look at the bottom of the admin panel
- Enable automatic updates: this ensures you get critical patches without delay
- Review your object cache configuration: if you use Redis or Memcached, verify it's properly secured
### Why Antidetect Browsers Matter for Security Professionals
For those of us who manage multiple online identities or work in digital privacy, this vulnerability highlights why tools like antidetect browsers are essential. When you're testing security configurations or managing multiple client sites, you need to ensure your own digital footprint doesn't become a liability.
An antidetect browser lets you create isolated browsing environments with unique fingerprints. If you're investigating security issues or managing sensitive accounts, this separation is crucial. The same principle applies to your WordPress sites: isolation and compartmentalization reduce risk.
### The Bigger Picture for WordPress Security
This isn't the first core vulnerability, and it won't be the last. WordPress powers over 40% of all websites, making it a prime target for attackers. The platform's popularity means that any flaw in core code has massive potential impact.
Key takeaways for site owners:
- Never assume you're safe just because you use few plugins
- Keep your WordPress installation updated within hours of security releases
- Monitor security news for critical vulnerabilities
- Consider using a Web Application Firewall (WAF) for additional protection
- Regularly audit your site for unauthorized changes
### Final Thoughts
The wp2shell vulnerability is a stark reminder that no software is immune to bugs. What matters is how quickly you respond when those bugs are discovered. The WordPress community did an excellent job of identifying, patching, and disclosing this flaw. Now it's up to you to make sure your site is protected.
Stay vigilant, keep your software updated, and always assume that someone out there is looking for the next way in.
