---
title: Remote code execution
canonical: https://wpsecurityninja.com/dictionary/remote-code-execution/
---
# Remote code execution

Remote code execution is a vulnerability that lets an attacker run attacker-controlled code on the server.

[Full guide](https://wpsecurityninja.com/wordpress-vulnerabilities-database/)

## FAQ

### Is RCE the same as a webshell?

No. RCE is the vulnerability class: a bug that lets an attacker run code. A webshell is a common payload they drop after (or via) that bug so they can keep running commands later. Fix the hole and remove the shell.

### How urgent is an RCE CVE on a plugin I use?

Treat it as emergency work. Update or remove the plugin as soon as a fix exists. If you must delay, disable the plugin and restrict access while you plan, then assume probes will arrive quickly.

## Why it matters for WordPress

RCE is near the top of the severity ladder. If a plugin or theme flaw lets someone execute PHP or shell commands, they can drop a webshell, read `wp-config.php`, or pivot further. Public RCE CVEs get scanned quickly. Treat them as drop-everything updates.

## How it shows up in practice

- Advisories labeled critical with “unauthenticated RCE” or “authenticated RCE”
- New PHP files appearing after exploit traffic in the logs
- Host notice that the account was used to attack other sites
- Privilege-escalation bugs that chain into code execution

## What to do

1. Update or remove the affected component as soon as a fix exists.
2. If you cannot patch yet, disable the plugin and restrict access while you plan.
3. After any suspected RCE, assume compromise: scan, rotate secrets, hunt backdoors.
4. Keep file upload and capability checks honest in custom code so you do not invent your own RCE.