wp2shell: a critical vulnerability in the core of WordPress allows remote code execution without authentication
A sanitation flaw in the WordPress core allows an unauthenticated attacker to run arbitrary code on the server. Patch immediately.
Jul 18, 2026 3 1