WordPress Issues Urgent Patches for Critical Remote Code Execution Flaw

SAN FRANCISCO — WordPress released emergency security updates on Thursday to address a critical vulnerability in its core software that allows unauthenticated attackers to execute arbitrary code remotely. The patches, applied to versions 6.9.5 and 7.0.2, fix a flaw dubbed "wp2shell" identified by Adam Kues of Searchlight Cyber at Assetnote.

The vulnerability stems from an anonymous HTTP request handling error within the default WordPress installation. Unlike many previous security issues that required attackers to exploit third-party plugins or themes, this flaw exists in the core software itself. Security researchers warn that any site running a vulnerable version without additional hardening measures is susceptible to immediate compromise if exposed to the internet.

The "wp2shell" vulnerability enables an attacker to send specifically crafted HTTP requests to a target server. Because no authentication credentials are required, malicious actors can bypass login screens entirely and inject code directly into the system. Successful exploitation grants attackers full control over the affected website, potentially allowing them to steal sensitive data, deface content, or use the compromised servers as part of a larger botnet.

WordPress developers emphasized that the flaw affects installations using default configurations. The update is mandatory for all users running versions prior to 6.9.5 and 7.0.2. Administrators are urged to apply the patches immediately through their hosting control panels or content management system dashboards. Failure to update leaves sites open to automated scanning tools that actively search for this specific vulnerability across the web.

Adam Kues, who discovered the flaw while conducting research at Assetnote's Searchlight Cyber unit, highlighted the severity of the issue due to its pre-authentication nature. The ability to execute code without first gaining access through a user account significantly lowers the barrier for entry for cybercriminals and state-sponsored actors alike.

The vulnerability was disclosed following responsible disclosure protocols, allowing WordPress engineers time to develop and deploy fixes before public details were released widely. However, security analysts note that in some cases, vulnerabilities of this magnitude are exploited by threat actors within hours or even minutes of becoming publicly known if patches are not applied instantly.

While the immediate risk is mitigated for those who have updated their systems, questions remain regarding the extent of any potential exploitation prior to Thursday's release. Security firms continue to monitor networks for signs that attackers may have already leveraged the wp2shell flaw against unpatched targets during the window between discovery and patch availability.

Experts advise site owners not only to update but also to review their server logs for suspicious activity, particularly any unusual HTTP requests originating from unknown IP addresses. As with all critical infrastructure updates, administrators must ensure that backups are current before applying changes to prevent data loss in case of compatibility issues during the upgrade process.