WordPress fixed a serious security flaw in WordPress itself on July 17. If you run a WordPress site, make sure it updated to 6.8.6, 6.9.5, or 7.0.2 — most sites auto-update, so log in and confirm — and check your admin users for anyone you don't recognize.
www.wordfence.com/blog/2026/07...
wordfence.com
wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade
wp2shell is a critical unauthenticated RCE chain in WordPress Core, patched July 17, 2026. See who's affected, the exploitation timeline, and what to do now.