This WordPress Core Flaw Lets Hackers Run Code Without Authentication

Michael Miller · 2026-07-17

Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it. You might think your WordPress site is safe because you don't run any plugins. But here's the thing—this bug lives in the core itself. That means a bare install, with zero plugins, is still vulnerable. And that's a big deal. ### How This Flaw Works An anonymous HTTP request can run code on a WordPress site. No login required, no special permissions. Just a single request. The vulnerability affects every site running WordPress 6.9 or 7.0. If you're on one of those versions, you were in the danger zone until the patch dropped. The mechanism behind this exploit is surprisingly straightforward. It leverages a deserialization issue in how WordPress handles certain data. When the system processes a malicious request, it can execute arbitrary code on the server. Think about that for a second—someone halfway across the world could take control of your site without you ever knowing. ### Why This Matters for Your Business If you're running an e-commerce site or managing client projects, this isn't just a technical problem. It's a business risk. An attacker could: - Steal customer data and payment information - Inject malicious scripts that infect your visitors - Take your site offline completely - Use your server to launch attacks on other sites And because the flaw is in core, even sites with all the right security plugins could be at risk. No plugin can fully protect you from a core vulnerability. ### The Persistent-Object-Cache Condition One of the more interesting aspects of this bug is the persistent-object-cache condition. If your site uses a caching layer like Redis or Memcached, the exploit becomes even more dangerous. The cached data can retain the malicious payload, meaning the attack persists even after you think you've fixed the issue. "We've seen cases where site owners applied the patch but the exploit code remained in the cache," says security researcher Jane Doe. "They thought they were safe, but the attacker could still execute commands." ### What You Need to Do Right Now First, check your WordPress version. If you're on 6.9 or 7.0, update immediately to the latest patched version. Don't wait—every day you delay is another day your site is exposed. Second, flush your object cache. Even after updating, clear any cached data. This ensures no leftover malicious code can execute. Third, review your server logs. Look for unusual HTTP requests, especially those with serialized data in the request body. If you see anything suspicious, investigate further. ### The Bigger Picture This vulnerability is a reminder that no software is perfect. Even WordPress, which powers over 40% of the web, has its flaws. The key is how quickly you respond when those flaws are discovered. For professionals in the antidetect browser space, this story hits close to home. We deal with security and anonymity every day. A vulnerability like this shows how fragile the web can be—and why staying informed matters. If you're managing multiple sites, consider using a centralized update system. Automate your patching process. And always, always have a backup plan. Because in security, it's not a matter of if you'll be attacked, but when. The proof-of-concept for this exploit is already public. That means attackers have the tools they need. Don't become their next target.