Cyber security WordPress wp2shell RCE hits 500 million sites, patch now wp2shell is a pre-authentication remote code execution chain in WordPress Core. Two CVEs let anonymous attackers run code on 6.9 and 7.0 sites with no plugins. Lars Cornelissen · Jul 19, 2026