> TritonInfoSec News
Home / Jul 18, 2026 / Story
0
#2 The Hacker News general July 17, 2026 at 21:20 UTC

New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

By [email protected] (The Hacker News)

AI Summary

A critical unauthenticated remote code execution flaw dubbed wp2shell was discovered in WordPress core by Adam Kues of Assetnote/Searchlight Cyber, affecting all WordPress 6.9 and 7.0 installations — no plugins required for exploitation. WordPress responded by shipping patched versions 6.9.5 and 7.0.2 and enabling forced auto-updates, but any site that hasn't received the update remains fully vulnerable to anonymous HTTP-based code execution.

Read full article → https://thehackernews.com/2026/07/new-wp2shell-wor…

Relevance score: 91.0/100

# More from July 18

  1. 1
    CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV The Hacker News
  2. 3
    Inc Ransomware Exploits SonicWall SMA Zero-Days Dark Reading
  3. 4
    OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests The Hacker News
  4. 5
    Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack The Hacker News
  5. 6
    Coca-Cola Suspends US Fairlife Production Due to Ransomware Attack SecurityWeek
  6. 7
    CISA urges immediate action on actively exploited Fortinet flaws BleepingComputer
  7. 8
    GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft The Hacker News
  8. 9
    New Windows LegacyHive zero-day gives hackers admin privileges BleepingComputer
  9. 10
    Now, even Russia's most elite hackers are using Clickfix to infect devices Ars Technica Security