WordPress Core Flaw Enables Unauthenticated Code Execution

The vulnerability was announced July 18, 2026, when two flaws were assigned CVE IDs and a full mechanism has been published. A persistent‑object‑cache condition surfaced, and a working proof‑of‑concept is now public. An anonymous HTTP request can execute code on a WordPress site because the bug resides in core, so a bare install without plugins is exploitable. All sites running WordPress 6.9 or 7.0 are affected until the latest patch.¹

Security specialists say the flaw stems from insufficient sanitization of user‑supplied data within core functions, allowing arbitrary code execution through specially crafted HTTP requests. This mirrors the 2017 WP2Shell issue but is more dangerous because it sits directly on the server; no plugin involvement is required. Attackers can gain full control over databases containing sensitive information such as usernames, passwords, email addresses, potentially leading into large‑scale identity theft or ransomware attacks if exploited effectively.¹

The earlier WP2Shell vulnerability existed in 2017; the current mechanism likely involves crafting an HTTP request that triggers PHP unserialisation with malicious data – not just SQL injection or cross‑site scripting anymore. Every site running vulnerable versions should immediately update and consider hardening their caching configuration to prevent future exploits—the persistent‑object condition means attackers can maintain control even after initial compromise. Expect widespread exploitation given how many sites still run outdated WordPress installations (estimates place roughly one in three websites using this CMS).¹