DigiNews

Summary

Security researchers reveal a pre-authentication RCE in WordPress Core ('wp2shell'), affecting multiple versions and enabling anonymous exploitation on stock installs. WordPress has released fixes (6.9.5 or 7.0.2) and a checker to verify vulnerability; mitigations include updating, disabling unauthenticated REST API access, blocking the REST batch endpoints with a WAF, or using a temporary plugin to require authentication for batch requests.