The Hacker News

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

WordPress fixes CVE-2026-64638, a pre-auth login XSS affecting every version, with a demonstrated path to PHP execution under ...
latesthackingnews.com

wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins

WordPress 6.9.5 and 7.0.2 fix wp2shell, a core REST API bug chaining route confusion and SQL injection into unauthenticated ...

wp2shell: Critical WordPress vulnerability allows code injection via API

By chaining an SQL injection and an API vulnerability, attackers can inject code. WordPress has released an update, the finders a hotfix.
GIGAZINE

Studio Code, an AI coding CLI tool specifically for WordPress, is now available for free in beta.

WordPress.com has released a beta version of Studio Code, an agent-based coding tool for WordPress. The development team explains that instead of polishing it into a finished product before release, ...