One Request, Full Control
Here’s the nightmare scenario every site owner dreads: an anonymous HTTP request — no login, no special privileges, nothing — and your WordPress installation is running code it shouldn’t. That’s the reality of wp2shell WordPress flaw, a core vulnerability that makes even a bare install with zero plugins exploitable.
The bug sat in WordPress core itself. Every site running version 6.9 or 7.0 was in range. That’s not a niche subset — that’s a massive chunk of the web’s content management backbone.
The Discovery: Assetnote’s Adam Kues
Adam Kues at Assetnote, the attack surface management arm of Searchlight Cyber, found the flaw. He reported it responsibly, and the WordPress team got to work. But the timeline here matters. The disclosure wasn’t a slow burn — it was a race to patch before the public knew what was possible.
Kues’s background in finding similar issues in other platforms likely helped him spot this one. Assetnote has a track record of digging into CMS internals, and this find is squarely in their wheelhouse.
What the Patch Looks Like
On Friday, WordPress shipped two versions: 6.9.5 and 7.0.2. Both close the hole. But here’s the twist — the team also enabled what it calls forced updates through the auto-update system. That’s a significant move. WordPress has always nudged users to update, but forcing the issue for a security patch is a departure from the usual gentle reminder.
The forced update mechanism means that even sites with auto-updates disabled for minor versions might get the fix pushed through. It’s a pragmatic response to a critical flaw, but it also raises questions about control. Do site owners want WordPress deciding when to update? In this case, the answer is probably yes — because the alternative is being hacked.
Why Core Bugs Are Especially Dangerous
Plugins get blamed for most WordPress breaches, and rightly so. But a core vulnerability changes the calculus. It’s not about a badly coded third-party add-on; it’s the foundation itself that’s cracked. The wp2shell WordPress flaw requires no plugins, no themes, no configuration changes. Out-of-the-box WordPress is vulnerable.
That’s why this one feels different. The attack surface is every single site running the affected versions. No excuses, no workarounds, no “just disable that plugin.”
What Site Owners Should Do Right Now
If you haven’t updated yet, stop reading and do it. Here’s the checklist:
- Check your WordPress version — if it’s below 6.9.5 or 7.0.2, you’re exposed.
- Log into your admin dashboard and look for the update prompt. If it’s not there, check manually under Updates.
- Verify the update actually applied by checking the version number in At a Glance or via
wp-cli if you use it.
- If you’re on a managed host, confirm they’ve applied the patch on their end.
Don’t assume the forced update got you. It’s designed to help, but you should still verify. A quick check takes two minutes and saves you from a potential takeover.
The Bigger Picture: WordPress Security in 2025
This isn’t the first core flaw, and it won’t be the last. WordPress powers over 40% of the web, making it a prime target for attackers who want maximum impact with minimal effort. The wp2shell WordPress flaw is a reminder that even the most popular CMS isn’t immune to critical bugs.
The good news? Responsible disclosure works. Assetnote didn’t sell the exploit or leak it; they reported it, and WordPress responded with a patch and an aggressive update push. That’s how the system is supposed to work.
But it also highlights the importance of staying current. If you’re running an old version of WordPress because you’re afraid updates will break something, this is your wake-up call. The risk of staying behind far outweighs the risk of a minor plugin incompatibility.
Final Thoughts
The wp2shell WordPress flaw is a serious issue, but it’s also a solved one — provided you update. Check your version, apply the patch, and move on. And maybe take a moment to appreciate the security researchers who find these bugs before the bad guys do.
For more on keeping your site secure, check out our guide on WordPress security hardening and learn how to protect your site from brute force attacks. Staying informed is half the battle.
