Severe Security Vulnerability Discovered in WordPress

A newly discovered security vulnerability in the WordPress core allows unauthorized attackers to execute code on affected websites. This flaw affects all installations of versions 6.9 and 7.0, even if no plugins are installed. The vulnerability was registered on July 18, 2026, with CVE IDs CVE-2026-1234 and CVE-2026-1235. The flaw enables attackers to access the WordPress installation via an anonymous HTTP request.

This means that an attacker can execute malicious code without authentication and without prior interaction with the website. The discovery of this vulnerability has alarmed the security community, as it potentially has far-reaching implications for millions of websites. A complete exploitation mechanism for this vulnerability has been published, and a working proof-of-concept is also available. This allows potential attackers to exploit the flaw quickly before a patch is provided. The release of the proof-of-concept has heightened the urgency to implement security updates.

Additionally, a condition for a persistent object cache has been identified that facilitates the exploitation of the vulnerability. This condition could allow attackers to obscure their activities and evade detection by security solutions. Experts advise website operators to take immediate action to protect their systems. The WordPress developers are already working on an update to address the vulnerabilities. An official update is expected in the coming days.

In the meantime, it is recommended to review the website's operating environment and implement additional security measures if necessary to minimize the risk of an attack. The vulnerability has the potential to jeopardize a wide range of websites, as WordPress is one of the most widely used content management systems worldwide. It is estimated that over 40% of all websites on the internet run on WordPress. This high prevalence makes the platform an attractive target for cybercriminals. The security community has already responded to the discovery and recommends regularly updating all WordPress installations and using security plugins to prevent potential attacks.

The importance of regular security reviews and updates is particularly emphasized in this context. The WordPress community has proven to be responsive to security threats in the past. The developers are committed to continuously improving the platform and quickly closing security gaps. However, the current situation requires immediate attention from all users. The vulnerability could also impact user experience, as affected websites may need to be taken offline to ensure security.

This could lead to a loss of traffic and potential revenue, especially for businesses that rely on their online presence. The publication of the CVE IDs and the proof-of-concept has already led to increased activity in hacker forums, underscoring the urgency to act quickly. The vulnerability is classified as critical, and developers strongly advise securing systems until an official update is available. The WordPress developers have announced that they aim to provide the security updates by July 25, 2026, to address the vulnerabilities.