New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

A vulnerability in the WordPress core allows unauthenticated attackers to run code on a WordPress site via an anonymous HTTP request. This flaw can be exploited even on a bare install with no plugins. WordPress sites running versions 6.9 and 7.0 were vulnerable until updates 6.9.5 and 7.0.2 were released. The updates were automatically applied through WordPress's auto-update system. The vulnerability was discovered by Adam Kues at Assetnote, a division of Searchlight Cyber. WordPress has since mitigated the issue with the release of the updated versions.