aelius Posted 9 hours ago Report Posted 9 hours ago On July 17, 2026, WordPress released versions 7.0.2 and 6.9.5 and triggered a forced automatic update across all affected installations, a measure the project reserves for the most severe cases. The cause is a vulnerability chain dubbed wp2shell, which lets an attacker without credentials execute code on the server starting from a single anonymous HTTP request. No plugins are required, no special configuration is needed: a freshly downloaded, never-touched WordPress installation is enough. Less than twenty-four hours after the patch was published, fourteen repositories with exploits, scanners, and test labs had already appeared on GitHub, the most followed of which counts 44 stars and 15 forks. Ref: - https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/ - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ - https://pasqualepillitteri.it/en/news/8405/wp2shell-wordpress-rce-cve-2026-63030-en - https://github.com/NULL200OK/WP2Shell Quote
