Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to analysis by Seqrite researcher Amruta Wagh. Dubbed WP2Shell, the exploit chain reportedly emerged in July 2026 and combines REST API route confusion with SQL injection, allowing attackers to progress from public endpoints to server compromise without possessing valid WordPress credentials. […] The post Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
First seen on gbhackers.com
Jump to article: gbhackers.com/critical-wordpress-flaws/
