A critical WordPress RCE vulnerability, wp2shell, was disclosed on 17 July 2026. It chains a REST API route confusion flaw with an SQL injection in WP_Query — no login required, no plugin involved. If my site were unpatched, an attacker could take full control. Check your WordPress version now. #WordPress #Security #WordPressSecurity #WebSecurity #RCE https://wpguy.uk/blog/is-your-wordpress-site-exposed-to-the-wp2shell-remote-code-execution-flaw/