Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it. An anonymous HTTP request can run code on a WordPress site.
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
Résumé + lien vers la source. Sans paywall, sans tracking.