What happened
Security researchers have found two serious flaws in the core software that runs WordPress, the platform behind a huge share of websites on the internet. The bugs, now tracked under official CVE numbers and nicknamed wp2shell, allow an attacker to send a single request to a website and run their own code on it. No password, no user account, and no plugin is required. A completely stock WordPress install, fresh out of the box, can be broken into.
What makes this especially serious is timing. Working proof-of-concept code showing exactly how to exploit the flaws is now public. That means the barrier to carrying out an attack has dropped from needing deep technical skill to basically copying and pasting a script. Every site running WordPress versions 6.9 or 7.0 that had not applied the fix was exposed.
Why this bug is different from most WordPress problems
Most WordPress security issues trace back to third party plugins or themes, not the core software itself. Site owners are used to hearing "update your plugins" as the main line of defense. This case is different because the vulnerable code lives in WordPress core, the part every single site relies on regardless of which plugins are installed.
Researchers also identified a related complication involving what is called a persistent object cache, a common performance feature many hosting setups use to speed up busy sites. On configurations using this caching feature, the conditions for exploitation can linger even after certain fixes, which is part of why this issue drew so much attention from security teams.
In plain terms: this was not a niche bug affecting a handful of poorly maintained sites. It touched a massive slice of the web, including sites that owners believed were locked down tight.
What an attacker can actually do
Remote code execution is about as bad as a website vulnerability gets. Once an attacker can run their own code on a server, they generally have full control of that site. That can mean:
- Stealing customer data, including names, emails, and payment information stored on the site
- Installing malware that infects visitors' devices
- Turning the site into a tool for sending spam or launching attacks on other websites
- Defacing the site or holding it for ransom
- Planting hidden backdoors that let them return even after the original bug is patched
Because the attack requires no login, automated bots can scan the internet for vulnerable sites and hit thousands of them without any human attacker lifting a finger beyond writing the initial script. That kind of mass, automated attack tends to move fast once exploit code is public, which is exactly the situation here.
Who needs to worry about this
This story mainly concerns people who run a WordPress website, whether that's a business, a blog, a nonprofit, or a personal project. If that's not you, there is no software to install or setting to change on your end. But it's worth knowing about anyway, because breached WordPress sites are frequently used to distribute malware or run phishing pages, so the fallout can eventually reach everyday visitors too.
If you manage a WordPress site directly, or you hired someone to build one for you, this is the kind of issue that deserves immediate attention rather than getting pushed to a future to-do list. Many hosting providers apply core WordPress updates automatically, but not all of them do, and some site owners have automatic updates turned off to avoid breaking custom themes or plugins.
What you should do
- If you run a WordPress site: Confirm you are on the latest patched version of WordPress core right now, not just up to date on plugins.
- Check your hosting settings: Make sure automatic core updates are turned on unless you have a specific, well-managed reason to disable them.
- Ask your web developer or agency: If someone else manages your site, contact them directly today and ask them to confirm the patch has been applied.
- Review recent activity: Look for unfamiliar admin accounts, unexpected files, or strange changes to your site, since these can be signs of a break in.
- If you just browse the web: Keep your browser and antivirus software updated, since compromised WordPress sites are sometimes used to spread malware to visitors.
This is one of those rare cases where waiting even a few days matters. With exploit code already circulating publicly, unpatched sites are an easy target, and there is no reason to leave that door open once a fix exists.
