WordPress powers an enormous share of the internet — over 500 million websites, by most estimates. That popularity is exactly why it's such an attractive target for attackers. Every time a serious vulnerability is discovered in WordPress core, plugins, or themes, it puts a huge number of sites at risk almost overnight. If you run a WordPress site — a personal blog, a client project, or your business's main storefront — understanding how these vulnerabilities work, and what to do about them, is essential.

A Wake-Up Call: The "wp2shell" Pre-Authentication RCE

A recent discovery from the security research team at Searchlight Cyber is a good example of how serious these issues can get. Their researchers identified a pre-authentication remote code execution (RCE) vulnerability in WordPress core itself — meaning an attacker doesn't need a username, password, or any prior access to exploit it. It works against a completely stock WordPress install, with no plugins required to trigger it.

That's about as bad as a vulnerability gets. A pre-auth RCE means an anonymous attacker, anywhere on the internet, could potentially run malicious code on a vulnerable site, steal data, plant malware, or take full control of it.

Because of how severe the bug is, Searchlight Cyber made the responsible decision not to publish full technical details right away, giving site owners a window to patch before attackers could reverse-engineer an exploit. They did, however, release a free tool so anyone can check whether their own WordPress install is vulnerable.

Affected versions, according to their research:

The fix: update to WordPress 7.0.2, or 6.9.5 if you're staying on the 6.9 branch, as soon as possible.

If you can't update immediately, Searchlight Cyber recommends a temporary — not permanent — workaround: block anonymous access to the WordPress REST API's batch endpoint, either by installing a plugin that restricts REST API access, or by blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 at your firewall (WAF) level. This can affect legitimate functionality that relies on the REST API, so treat it as a stopgap until you can actually update.

Full credit for identifying and responsibly disclosing this vulnerability goes to the Searchlight Cyber research team. Their original technical write-up, including a free tool to check whether your own site is exposed, is worth reading in full: wp2shell: Pre-Authentication RCE in WordPress Core.

Why This Keeps Happening

WordPress core, themes, and plugins are all actively maintained software, and like any software, they contain bugs. Some of those bugs turn out to have security implications, and security researchers are constantly probing for them — which is a good thing, since it means vulnerabilities get found and reported so they can be fixed, rather than being discovered first by criminals.

But it also means new vulnerabilities are disclosed regularly, across WordPress core and the tens of thousands of plugins and themes available for it. A site that was perfectly secure last month can become an easy target this month simply because a new flaw was found in something it's running. The moment a vulnerability is disclosed — even responsibly, as Searchlight Cyber did here — it becomes a race between site owners applying the fix and attackers building tools to exploit it. Automated scanning bots typically start probing the internet for unpatched sites within days, sometimes hours, of a disclosure.

Update Everything, Every Time — No Exceptions

If there's one habit that will do more for your site's security than almost anything else, it's this: keep WordPress core, your theme, and every single plugin updated to the latest version, always.

Add a Firewall: Your First Line of Defense

Even with a disciplined update routine, there will always be a window between a vulnerability existing and you patching it. A Web Application Firewall (WAF) plugin helps close that gap by filtering out malicious requests before they ever reach your vulnerable code.

Some well-established WordPress firewall and security plugins worth considering:

Many hosting providers also offer server-level or CDN-based firewalls that filter traffic before it even reaches your site — these complement a plugin-based firewall nicely.

Back Up Regularly: Your Safety Net

No security measure is 100% foolproof, which is why backups aren't optional either. If a vulnerability does get exploited on your site, a recent, clean backup is often the difference between a quick recovery and a disaster.

A good rule of thumb: back up automatically on a schedule that matches how often your site changes, store backups somewhere off your own server, and periodically test that you can actually restore from one — a backup you've never tested is not a backup you can rely on.

Putting It All Together

Vulnerabilities like the one Searchlight Cyber uncovered are a reminder that WordPress security isn't a "set it and forget it" task. The good news is that the core habits that protect you are simple and within reach for site owners of any technical level:

Running WordPress and would rather do everything yourself? That's exactly the kind of thing you can do with our built in WordPress manager in your very own cPanel.