Hackers Exploit Critical WordPress Flaws to Execute Remote Code Without Authentication
A critical WordPress exploit chain dubbed WP2Shell lets unauthenticated attackers run arbitrary code on vulnerable websites by combining REST API route confusion with SQL injection. Seqrite researcher Amruta Wagh describes the chain as a WordPress Core security issue disclosed in July 2026 that eliminates the need for attackers to obtain credentials before exploiting. The analysis […] The post Hackers Exploit Critical WordPress Flaws to Execute Remote Code Without Authentication appeared first on Cyber Security News .