This WordPress Core Bug Lets Hackers Run Code Without a Password

Robert Moore · 2026-07-17

Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it. You don't need a password. You don't need a plugin. You don't even need to be logged in. An anonymous HTTP request can run code on a WordPress site. That's the reality of the newly discovered wp2shell vulnerability, and it's a big deal. This bug lives in WordPress core. That means a bare install with zero plugins is fully exploitable. Every site running version 6.9 or 7.0 was in range until the patch dropped. If you haven't updated yet, you're still at risk. ### What Makes wp2shell Different Most WordPress vulnerabilities target plugins or themes. This one is different. It's in the core software itself, which means it affects millions of sites regardless of what extras you've installed. Think of it like a weak spot in the foundation of a house, not just a crack in the wallpaper. The attack vector is surprisingly simple. An unauthenticated user sends a specially crafted HTTP request to the site. The request triggers a chain of events that ultimately allows remote code execution. That's the worst kind of vulnerability because it gives an attacker complete control over your server. ### The Technical Breakdown Here's what we know about the flaw: - **CVE IDs assigned**: The two related vulnerabilities now have official CVE identifiers, making tracking and patching easier. - **Persistent object cache condition**: A specific configuration involving object caching can make exploitation even more dangerous. - **Proof-of-concept published**: Security researchers have released a working PoC, meaning attackers now have a blueprint to follow. - **No authentication required**: The attack works without any login credentials, which dramatically expands the pool of potential targets. The persistent-object-cache condition is particularly concerning. When sites use caching systems like Redis or Memcached, the bug can be triggered more reliably. This is a reminder that performance optimizations sometimes come with security trade-offs. ### Who Should Be Worried If you run a WordPress site, you should be worried. The numbers are staggering: - Over 40% of all websites run WordPress - Versions 6.9 and 7.0 represent a significant portion of active installs - Many site owners haven't applied the patch yet - Automated scanning tools are already looking for vulnerable sites Small business owners, bloggers, and enterprise teams are all in the same boat. The bug doesn't discriminate based on site size or traffic volume. ### What You Need to Do Right Now Your first step is obvious: update WordPress to the latest version. Check your admin dashboard and apply any pending updates immediately. If you're using a managed hosting provider, they may have already patched your site on the backend. But don't stop there. After updating: 1. Review your user accounts for any suspicious activity 2. Check your server logs for unusual HTTP requests 3. Run a security scan using a reputable plugin 4. Consider implementing a web application firewall (WAF) 5. Enable two-factor authentication for all admin accounts The window for exploitation is wide open. Attackers are actively scanning for vulnerable sites, and with a public PoC available, the barrier to entry is practically zero. ### The Bigger Picture This vulnerability highlights a uncomfortable truth about web security: even the most popular platforms have blind spots. WordPress powers a huge chunk of the internet, and when a core flaw emerges, the ripple effects are enormous. The wp2shell bug also raises questions about how vulnerabilities are disclosed. The researchers who found the flaw followed responsible disclosure practices, but the public PoC release means the clock is ticking for site owners who haven't patched. Security isn't a one-time task. It's an ongoing process that requires vigilance, regular updates, and a willingness to act quickly when threats emerge. This bug is a wake-up call for anyone who assumed their WordPress site was safe by default. Stay safe out there. Update your sites, monitor your logs, and don't assume you're not a target. The attackers are counting on your complacency.