A newly discovered flaw in WordPress core, dubbed “wp2shell,” allows unauthenticated attackers to inject and run malicious code on affected websites. The vulnerability is particularly concerning because it can be exploited without needing any login credentials or exploiting a separate vulnerability first. As a result, millions of WordPress users are at risk of falling victim to this attack.
The wp2shell flaw stems from an issue with how WordPress handles certain file operations. When a user requests a specific resource on their website, the platform checks if it exists in memory. However, when the requested resource is not found, WordPress falls back to executing a different script that’s designed to handle such situations. The problem lies in this fallback mechanism, which allows an attacker to inject arbitrary code by manipulating the URL of the requested resource.
According to researchers who discovered the vulnerability, attackers can exploit wp2shell by crafting a malicious URL and visiting it on an affected website. This will trigger WordPress’s fallback script, allowing the attacker to execute their own code. The potential consequences are severe: attackers could gain unauthorized access to sensitive data, inject malware, or even take control of an entire website.
The impact of this vulnerability extends far beyond individual websites, as millions of WordPress users worldwide rely on the platform for everything from blogs and portfolios to e-commerce sites and enterprise applications. WordPress powers around 40% of all websites on the internet, making it a prime target for attackers seeking to spread malware or disrupt online services.
To mitigate the risk associated with wp2shell, it’s essential that website administrators prioritize patching their installations as soon as possible. This can be done by updating WordPress core and any installed plugins or themes to the latest available versions. Additionally, users should be cautious when visiting unfamiliar websites or clicking on suspicious links, as these could potentially lead to an exploitation of this vulnerability.
Ultimately, the discovery of wp2shell serves as a stark reminder of the importance of staying up-to-date with security patches and being mindful of potential threats when online. By taking proactive steps to secure their websites and being aware of the risks associated with software vulnerabilities, users can help minimize the likelihood of falling victim to an attack like this one.
Source: The Hacker News — 2026-07-17