WordPress Core "wp2shell" RCE Flaws Get Public Exploits — Patch Now

Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, dramatically raising the risk to the estimated 800+ million WordPress-powered websites worldwide. Site administrators are urged to patch immediately as active exploitation is expected imminently.

What Is wp2shell?

The wp2shell vulnerabilities are a set of critical remote code execution (RCE) flaws discovered in WordPress Core. The name references the attack chain's ability to convert a WordPress web request into a shell — effectively giving an unauthenticated attacker arbitrary command execution on the underlying server.

With the release of public exploit code, the barrier to exploitation has dropped dramatically. Previously, exploiting these flaws required significant technical expertise. Now, script-kiddie-level attackers can deploy the exploits with minimal effort.

Current Situation

Why This Is Urgent

The publication of working exploit code is a critical inflection point:

1. Automation is trivial — public exploits can be scripted to scan and attack millions of sites within hours
2. WordPress powers ~43% of all websites — the attack surface is enormous
3. Many sites run outdated WordPress versions due to plugin compatibility concerns or neglect
4. RCE means full server compromise — attackers can deploy malware, steal data, install backdoors, or pivot into hosting infrastructure
5. Shared hosting amplification — one compromised hosting account can affect dozens of co-hosted sites

Who Is at Risk

• All WordPress sites running unpatched versions of WordPress Core
• Sites with auto-updates disabled (common in managed/agency environments)
• WooCommerce and high-value stores — prime ransomware and data-theft targets
• Sites on shared hosting where a neighboring compromised site could affect yours

Remediation — Act Now

1. Update WordPress Core Immediately

From your WordPress dashboard:

Dashboard → Updates → Update Now

Or via WP-CLI:

wp core update
wp core version

2. Enable Auto-Updates (if not already active)

Add to wp-config.php:

define('WP_AUTO_UPDATE_CORE', true);

3. Check for Compromise

Signs your site may already be compromised:

• Unexpected admin users in Users → All Users
• Modified core files (use wp core verify-checksums to detect changes)
• Unknown files in wp-content/uploads/ with .php extensions
• Outbound connections to unfamiliar IPs from your server

Run a core integrity check:

wp core verify-checksums

4. Harden Your WordPress Installation

• Disable PHP execution in wp-content/uploads/ — add an .htaccess file:

<Files *.php>
deny from all
</Files>

• Use a WAF (Cloudflare, Sucuri, Wordfence) to block exploit traffic while patching
• Restrict wp-admin access by IP if possible
• Remove unused plugins and themes — they expand the attack surface

Detection

If you manage multiple WordPress sites, scan for exploitation indicators:

# Check for PHP files in uploads directories (web shells)
find /var/www -path "*/uploads/*.php" -type f
 
# Check WordPress core file integrity
wp core verify-checksums --path=/var/www/html
 
# Check for new admin users
wp user list --role=administrator

Monitor server access logs for:

• POST requests to unexpected WordPress endpoints
• Requests to PHP files in /wp-content/uploads/
• Unusual process spawning from the web server user

Broader Context

WordPress RCE vulnerabilities in Core — as opposed to plugins — are relatively rare, which makes wp2shell significant. Core flaws affect every unpatched WordPress installation regardless of plugin or theme choices. The combination of a core-level flaw, critical RCE, and now public exploits puts this in the same urgency tier as historically damaging WordPress mass-exploitation events.

Key Takeaways

• Public exploits for wp2shell RCE in WordPress Core are now circulating
• Mass scanning and exploitation of unpatched sites is likely underway or imminent
• Update WordPress Core immediately — this cannot wait
• Check for compromise indicators if your site was exposed before patching
• Enable auto-updates and WAF protection as ongoing defense measures

References

• BleepingComputer — WordPress Core "wp2shell" RCE flaws get public exploits, patch now
• WordPress.org — Security Releases
• WP-CLI — Core Commands