Zero‑day wp2shell RCE forces urgent WordPress core updates
An unauthenticated remote code execution flaw—wp2shell—affects clean WordPress 6.9.x and 7.0.x installs, letting attackers run code via a REST batch endpoint. WordPress patched it in 6.9.5 and 7.0.2 and enabled forced auto‑updates, so sites must upgrade immediately or apply temporary WAF blocks.