Breach404
Back to Insights
Cloud Security2 min readJuly 17, 2026

New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

A critical vulnerability in WordPress core, tracked as wp2shell, allows attackers without any authentication to execute arbitrary code on affected websites. You must immediately update WordPress to the latest patched version and monitor your systems for a

Could your website be vulnerable to attacks like this?

Run a free 10-point security scan on your site — headers, SSL, DNS, and more. Results in 15 seconds.

Test Your Site Now — It's Free