This WordPress Core Flaw Lets Anyone Run Code Without a Login

Michael Miller · 2026-07-17

Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it. Here's the thing about WordPress security bugs: most of them come from plugins or themes. You can blame a dodgy contact form or an outdated slider for those headaches. But this one's different. It lives in core, the very foundation of WordPress itself. That means even a brand-new install with zero plugins is vulnerable. An anonymous HTTP request can run code on a WordPress site. No login, no special privileges, just a carefully crafted request sent over the web. And the worst part? Every WordPress site running version 6.9 or 7.0 was in range until the patch dropped. ### What's Actually Happening Here? This isn't your average cross-site scripting or SQL injection. We're talking about remote code execution (RCE). An attacker can send a single request and have your server execute arbitrary PHP code. Think about what that means: they could read your database, upload malicious files, or even take full control of the server. The bug was discovered by a security researcher who goes by the handle wp2shell. They found that WordPress core mishandles certain HTTP headers in a way that allows an attacker to bypass authentication checks. The result? A path straight to code execution. - No authentication required - No plugins needed to exploit - Affects both 6.9 and 7.0 branches - Working proof-of-concept is already public This last point is critical. Once a POC is public, the race is on. Attackers will be scanning for vulnerable sites within hours, if not minutes. ### The Persistent-Object-Cache Twist Here's where it gets interesting. The researchers found that sites using a persistent object cache (like Redis or Memcached) have a slightly different attack surface. The cache condition can either amplify or mitigate the exploit depending on how it's configured. If you're running a caching layer, you need to check your configuration immediately. Most WordPress hosting providers have already applied virtual patches. But if you're managing your own server or using a less common host, you're on your own. Don't assume you're safe just because you didn't see an alert. ### What You Need to Do Right Now If you're running WordPress 6.9.x or 7.0.x, update to the latest version immediately. The patch was included in the July 18, 2026 maintenance release. If you can't update right away, consider these temporary measures: 1. Use a web application firewall (WAF) to block suspicious requests 2. Disable XML-RPC if you don't need it 3. Monitor your server logs for unusual HTTP requests 4. Limit file write permissions on your web root Remember, this isn't a theoretical threat. The proof-of-concept is out there, and automated scanning tools are already circulating. Every hour you delay is an hour your site is exposed. ### The Bigger Picture WordPress powers over 40% of the web. When a core vulnerability like this drops, it's not just a few sites at risk. It's millions. The fact that this bug was found in core code that's been around for years is sobering. It reminds us that even the most trusted software can have hidden flaws. For antidetect browser professionals, this story has a parallel. Just like WordPress relies on its core to stay secure, your antidetect browser relies on its fingerprinting engine to keep you anonymous. A single flaw in that engine can expose everything. That's why choosing the best antidetect browser isn't just about features. It's about how quickly the team responds to vulnerabilities. Stay safe out there. Update your sites, check your configurations, and never assume you're immune.