New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-07-17 21:20 UTC
Importiert: 2026-07-24 10:38 UTC
Quelle-ID: thn_global
uid_hash: ff4123046059f7b0d03db4057c5ea1a56322eeaea4e11bb7b94c1e87de8a1ae5

The Hacker News

Inhalt

Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it.

An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable. Every 6.9 and 7.0 site was in range until

No data

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste