WordPress Core "wp2shell" RCE flaws get public exploits, patch now

A critical security situation has emerged as public exploits become available for remote code execution (RCE) vulnerabilities known as "wp2shell" within the WordPress Core. According to reports from BleepingComputer and Help Net Security, these vulnerabilities are classified as high severity and require immediate patching to prevent unauthorized access. TechCrunch reports that hackers are actively exploiting these recently patched bugs, a development that places millions of websites at risk of compromise if administrators fail to update their installations promptly. Coverage from The Hacker News and wiz.io emphasizes that the situation is escalating as the availability of public exploits fuels a surge in mass scanning activities. SecurityWeek further confirms that these wp2shell vulnerabilities are being exploited in the wild, indicating that threat actors are actively targeting vulnerable WordPress sites.

The reporting across these outlets highlights a race between attackers utilizing automated scanning tools and website owners who must apply the necessary security patches to secure their systems. To understand the current risk, readers should note that WordPress Core is the foundational software for a vast portion of the internet. The appearance of RCE flaws is particularly dangerous because it allows an attacker to execute arbitrary code on a server. As noted in a weekly recap by The Hacker News, this incident coincides with other significant threats, including SonicWall 0-Days, AI service attacks, and a SharePoint 0-Day, suggesting a broader environment of heightened cyber risk across multiple platforms. Looking ahead, the primary focus remains on the rate of patching across the global WordPress ecosystem.

Because public exploits are now available, coverage suggests that mass scanning will likely continue. The immediate priority for users is to patch the identified vulnerabilities. Further developments will depend on whether the exploitation grows in scale and how many websites remain vulnerable to the wp2shell flaws despite the availability of the security updates.