WordPress core has an unauthenticated RCE (wp2shell), confirmed as SQL injection. Update to 7.0.2 or 6.9.5 now, with mitigations if you can’t patch yet. Block the attack class at runtime with Aikido Zen.
Unauthenticated RCE in WordPress core (wp2shell), via SQL injection
calendar_today
July 17, 2026
domain
aikido-security