WordPress shipped emergency security releases 6.9.5 and 7.0.2 this week, patching a critical vulnerability dubbed wp2shell. The flaw lets an unauthenticated attacker execute arbitrary code on a default installation with zero plugins — which is exactly why you should update today.
What wp2shell actually allows
wp2shell is a pre-authentication remote code execution (RCE) vulnerability living directly in WordPress core. Unlike most of the security incidents from recent weeks, which involved third-party plugins — think of the ShapedPlugin supply-chain attack or the Kirki plugin flaw — this bug affects the core itself. Every site is exposed, regardless of which plugins or themes are installed.
The attacker needs no credentials and no user interaction. A single specially crafted request against a default install is enough to gain the ability to run arbitrary code on the server. That puts wp2shell into one of the most severe vulnerability categories there is: full site takeover, backdoor installation, or using the server as a launchpad for further attacks.
How WordPress responded
The WordPress core team released two fix versions simultaneously on July 17, 2026: 6.9.5 for the older stable branch and 7.0.2 for the current 7.0 line, which only recently brought AI features into core. As far as is known, no confirmed exploitation in the wild was reported before the patch shipped. That’s good news, but it’s also exactly the kind of bug that turns into a target for mass automated scanning the moment technical details go public.
History of similar core vulnerabilities shows a clear pattern: once a patch is out, researchers and attackers alike reverse-engineer it within hours to days, work out the precise shape of the bug, and start scanning for sites that haven’t updated yet. The window between a fix shipping and mass exploitation keeps shrinking.
How to check if your site is exposed
Every install on 6.9.4 or earlier, and 7.0.1 or earlier, is vulnerable. Check your version under Tools → Site Health in wp-admin, or simply run wp core version via WP-CLI. If you manage multiple sites on one host, it’s worth scripting a bulk check across all installs at once.
What to do right now
The first step is updating to 6.9.5 or 7.0.2 immediately. On most hosts, clicking the update button in wp-admin is enough; on managed servers, wp core update does the job. Back up your database and files before updating — a good habit before any core update, security patch or not.
Long term, turn on automatic updates for minor (security) releases so you’re not scrambling under time pressure next time. Also check your server logs from the last few days for suspicious requests to unusual URLs or repeated attempts to access nonexistent files — a common trace of vulnerability scanning.
The bigger picture
This incident lands just weeks after the WordPress 7.0 rollout brought AI features into core, and a week after the ShapedPlugin attack made headlines. The pattern is clear: the bigger and more complex a CMS core gets, the bigger its attack surface. For site owners, that means one thing — security updates aren’t an optional line on the to-do list, they’re a priority task that should either run automatically or happen within 24 to 48 hours of release.
Why patching core shouldn’t wait
Many site owners put off updates out of fear they’ll break a plugin or theme. For security minor releases like 6.9.5 and 7.0.2, that risk is minimal — these are targeted fixes, not major-version jumps that change API behavior. If you’re running a heavily customized site, test the update on staging first, but don’t push it back more than a day or two. For critical RCE vulnerabilities, the speed of deploying a patch matters more than perfect certainty that nothing will break.
Agencies and freelancers managing dozens of client sites should treat this incident as a prompt to review their own process: do you have visibility into which sites are running which WordPress version? Do you have a bulk alert set up for when a security patch ships? If not, wp2shell is a good reason to finally put that process in place.
Conclusion
The wp2shell vulnerability is a reminder that WordPress security starts with something as simple as keeping core up to date. If you haven’t already, update to 6.9.5 or 7.0.2 today, and consider enabling automatic security updates across all your sites. Need help with a security audit or setting up automatic updates? Get in touch.
