Critical WordPress Core RCE Flaw Affects All 6.9 and 7.0 Sites

A critical security vulnerability has been discovered in WordPress core that allows unauthenticated attackers to execute arbitrary code on affected websites. The flaw impacts all WordPress installations running versions 6.9 and 7.0, meaning even sites with no plugins installed are potentially exploitable.

Security researchers have confirmed that the vulnerability can be triggered through anonymous HTTP requests, making it particularly dangerous as no authentication is required to exploit it. The issue has been assigned two CVE identifiers and a working proof-of-concept has been made public, increasing the urgency for site administrators to take immediate action.

Vulnerability Details

• The flaw resides in WordPress core functionality, making all 6.9 and 7.0 installations vulnerable by default
• Two separate CVEs (CVE-2026-2224 and CVE-2026-2225) have been assigned to the issues
• No authentication required - attackers can exploit the vulnerability anonymously
• Even minimal WordPress installations without any plugins are affected
• Persistent object cache configurations may affect how the vulnerability manifests

Impact and Recommendations

• All WordPress sites running versions 6.9 and 7.0 should be considered compromised if not yet patched
• A public proof-of-concept exploit exists, increasing the likelihood of active exploitation
• Site administrators should immediately update to the latest patched WordPress version
• Organizations should audit their WordPress installations for signs of compromise
• Consider implementing temporary web application firewall rules if immediate patching isn't possible

Sources

• New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code