WordPress emergency patch critical core RCE wp2shell

WordPress has released an emergency core security update to address a critical vulnerability designated as 'wp2shell'. The bug allows unauthenticated attackers to execute remote code on default WordPress installations, presenting a severe risk to millions of websites that power over 40% of the public web.

The vulnerability resides in the core REST API routing handler. By sending a crafted HTTP payload to default endpoints, attackers can inject malicious PHP code into background scheduled tasks. Because these tasks execute with administrative privileges, the exploit allows for complete takeover of the hosting server.

Emergency Patch to Secure Over 40% of the Web

Security monitoring firms report that automated botnets began scanning the internet for vulnerable sites within minutes of the vulnerability's public disclosure. Web application firewall (WAF) providers have deployed temporary rules to block the exploit, but administrators are urged to apply the official core update immediately.

Active Exploitation and Defensive Measures

The severity of the wp2shell bug highlights the ongoing challenge of securing open-source web infrastructure. Webmasters should enable automatic core security updates and limit access to the `/wp-json/` REST API namespaces to authenticated users only to minimize their public attack surface.