A critical WordPress core flaw allows unauthenticated attackers to run code on any site running versions 6.9 or 7.0. Update immediately to protect your site.
Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it.
An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable. Every 6.9 and 7.0 site was in range until the latest patch.
### What Makes This Flaw So Dangerous?
Here's the thing: most WordPress vulnerabilities target plugins or themes. You can usually protect yourself by keeping those updated. But this one is different. It lives in the core code itself, which means even a brand new WordPress installation with nothing extra installed is vulnerable.
A single HTTP request from an unauthenticated user can trigger remote code execution. That's not a drill. The attacker doesn't need a username, password, or any special access. They just send a specially crafted request, and your server runs their code.
### The Technical Breakdown
The flaw involves a deserialization issue in WordPress's object cache handling. When the system processes certain data, it doesn't properly validate the input before passing it to PHP's unserialize function. That function can instantiate arbitrary objects and call magic methods like `__wakeup()` or `__destruct()`, which can be chained into code execution.
- **CVE IDs assigned**: The flaws now have official identifiers, making tracking easier.
- **Proof-of-concept public**: A working exploit is available, so attackers have a blueprint.
- **Persistent cache condition**: Sites using persistent object caching (like Redis or Memcached) face a higher risk because the exploit can survive across requests.
### Who Is Affected?
Every WordPress site running version 6.9 or 7.0 was exposed until the patch was released. If you haven't updated to the latest version, your site is still vulnerable. Check your admin dashboard right now.
### How to Protect Your Site
1. **Update immediately**: Go to your WordPress admin and apply the latest core update. This is non-negotiable.
2. **Review your cache setup**: If you use persistent object caching, verify that your caching plugin has also been updated. The exploit leverages cache behavior.
3. **Monitor for unusual activity**: Look for unexpected HTTP requests to your site, especially POST requests with unusual payloads.
### What This Means for the Future
This isn't just another security bulletin. It shows that even the most trusted platforms can have critical bugs hiding in plain sight. WordPress powers over 40% of the web, so a flaw like this has massive implications. The fact that it went undetected for months is a wake-up call for everyone who runs a site.
### The Bottom Line
If you manage a WordPress site, stop reading and go update it right now. Seriously. This is one of those rare vulnerabilities that checks every box: remote, unauthenticated, code execution, and core-level. Don't wait until you see suspicious files on your server.
Stay safe out there. And if you're running multiple sites, consider using an antidetect browser to manage them securely while you audit your infrastructure.
