wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade

wp2shell is a critical unauthenticated RCE chain in WordPress Core, patched July 17, 2026. See who's affected, the exploitation timeline, and what to do now.