WordPress Core "wp2shell" RCE flaws get public exploits, patch now

Saturday, July 18, 2026 at 05:22 PM UTC·Source: BleepingComputer

Updated: Saturday, July 18, 2026 at 06:00 PM UTC

Executive Summary

Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately. [...]

Analysis

Source Attribution

Originally published by BleepingComputer on Jul 18, 2026.

Related Threats

CRITICALVulnerabilityNEW

Rails patches critical Active Storage flaw with RCE potential

A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE). [...]

48m agoBleepingComputer

HIGHVulnerability

NVD HIGH: CVE-2026-67343 — ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the...

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operatio

CVE-2026-67343

1h agoNIST NVD

CRITICALVulnerability

NVD CRITICAL: CVE-2026-67342 — ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in...

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

CVE-2026-67342

1h agoNIST NVD