Post #3941037
2026-07-19 18:18 UTC
This vulnerability is OMGWTFBBQ level of seriousness. wp2shell is a pre-authentication RCE in WordPress Core. No login, no plugins, no preconditions. An anonymous attacker can hit a stock install and take over the site. The worst WP security vulnerability in a long time. Update!
Replies (1)
-
@dvk@toot.re 2026-07-19 18:24
@Jeffro@wptoots.social Indeed. And it is already actively being exploited at scale. One of my sites got hacked because of it. No harm done fortunately, but still a weird experience.