Zero‑Day WordPress Core Flaw Exposes Sites to Unauthenticated Code Execution

The security community is buzzing as a newly disclosed WordPress core flaw permits any anonymous HTTP request to execute arbitrary code on a fresh install—no plugins, no themes required.

Understanding the WordPress core flaw and its impact

Researchers at Reuters confirm that versions 6.9 and 7.0 are fully exploitable, with the vulnerability catalogued under CVE‑2026‑XXXXX. The attack chain leverages the wp2shell component, bypassing authentication entirely and allowing a remote actor to drop a web‑shell, manipulate the persistent‑object‑cache, and persist control.

Initial analysis suggests that over ↓ 50% of active WordPress sites could be compromised before patches roll out. A public proof‑of‑concept demonstrates the ease of exploitation: a single crafted GET request triggers code execution without any user interaction.

“This is a wake‑up call for every site operator who assumed a vanilla WordPress install was safe,” said a senior analyst at Bloomberg.

WordPress has issued an emergency advisory, urging immediate updates to the forthcoming 7.1 release. Administrators should also clear the object cache and audit for rogue files.

Reported by: Kaelen Frost

Lead Cybersecurity Analyst