WordPress Patches Critical Core RCE wp2shell Bug

WordPress Core has released an emergency security update to resolve a critical pre-authentication Remote Code Execution (RCE) vulnerability designated as 'wp2shell'. The vulnerability, discovered by security researchers, allows anonymous remote attackers to execute arbitrary PHP code on default WordPress installations without requiring user credentials.

The flaw exists within the core REST API routing logic, where improper input sanitization allowed attackers to inject malicious payloads into scheduled background tasks. Because default installations expose these API endpoints to the public internet, millions of websites were vulnerable to immediate compromise prior to the patch release.

Neutralizing a High-Impact Vector in WordPress Core

Security firms report that exploit attempts targeting the wp2shell vulnerability have surged immediately following the public disclosure. Web application firewall (WAF) providers have deployed temporary rule updates to block known attack patterns, but administrators are urged to apply the official WordPress Core update immediately to secure their servers.

Mitigation Strategies and Active Exploitation Risks

This incident underscores the persistent risks associated with core software dependencies in the web ecosystem. As WordPress powers over 40% of all websites, vulnerabilities of this severity present systemic threats to web infrastructure, emphasizing the importance of enabling automated security updates for production deployments.