CVEs Assigned for wp2shell + Public PoC: Technical Deep Dive

Team,

As of the July 18th update, the wp2shell situation has escalated significantly. The two critical flaws now have official CVE identifiers (CVE-2026-3929 and CVE-2026-3930), and a working proof-of-concept is circulating in the wild.

To recap: this is a core vulnerability affecting WordPress 6.9 and 7.0. It doesn't rely on plugins. The exploitation path involves a specific condition within the persistent-object-cache implementation, allowing an unauthenticated attacker to trigger deserialization and ultimately achieve Remote Code Execution (RCE) via a single anonymous HTTP request.

If you're running a WP instance, even a 'bare metal' install, you are in the crosshairs. The mechanism is particularly nasty because it bypasses standard authentication checks entirely.

For those needing to audit their infrastructure rapidly, here is a Python snippet to programmatically check versions across multiple directories:

import subprocess
import re

def check_wp_version(directory):
    try:
        # Assumes WP-CLI is installed
        result = subprocess.run(['wp', 'core', 'version', '--path=' + directory], capture_output=True, text=True, timeout=10)
        version = result.stdout.strip()
        if "6.9" in version or "7.0" in version:
            return f"[!] VULNERABLE: {version} at {directory}"
        return f"[+] Safe: {version} at {directory}"
    except Exception as e:
        return f"Error checking {directory}: {e}"

print(check_wp_version("/var/www/html"))


On the detection side, since this relies on specific malformed requests, keep an eye out for unusual POST traffic to core endpoints that typically don't accept external input, often accompanied by a 500 or 200 OK status where 403/404 is expected.

Given the severity and the public PoC, I'm wondering: are we seeing widespread automated exploitation yet, or is this still largely targeted? How are your teams handling the patching cadence for this one?