---
title: Remote code execution
canonical: https://wpsecurityninja.com/dictionary/remote-code-execution/
---
# Remote code execution

Remote code execution is a vulnerability that lets an attacker run attacker-controlled code on the server.

Last updated: 2026-08-26

Also called: RCE, remote code execution vulnerability

## Related terms

- [Vulnerability](https://wpsecurityninja.com/dictionary/vulnerability/): A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- [Webshell](https://wpsecurityninja.com/dictionary/webshell/): A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
- [File upload vulnerability](https://wpsecurityninja.com/dictionary/file-upload-vulnerability/): A file upload vulnerability lets an attacker place a dangerous file on the server, often leading to a webshell.
- [CVE](https://wpsecurityninja.com/dictionary/cve/): A CVE is a public identifier for a known cybersecurity vulnerability tracked in shared databases.
- [Privilege escalation](https://wpsecurityninja.com/dictionary/privilege-escalation/): Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.

[Full guide](https://wpsecurityninja.com/wordpress-vulnerabilities-database/)

## FAQ

### Is RCE the same as a webshell?

No. RCE is the vulnerability class: a bug that lets an attacker run code. A webshell is a common payload they drop after (or via) that bug so they can keep running commands later. Fix the hole and remove the shell.

### How urgent is an RCE CVE on a plugin I use?

Treat it as emergency work. Update or remove the plugin as soon as a fix exists. If you must delay, disable the plugin and restrict access while you plan, then assume probes will arrive quickly.

## Why it matters for WordPress

RCE is near the top of the severity ladder. If a plugin or theme flaw lets someone execute PHP or shell commands, they can drop a webshell, read `wp-config.php`, or pivot further. Public RCE CVEs get scanned quickly. Treat them as drop-everything updates.

## How it shows up in practice

- Advisories labeled critical with “unauthenticated RCE” or “authenticated RCE”
- New PHP files appearing after exploit traffic in the logs
- Host notice that the account was used to attack other sites
- Privilege-escalation bugs that chain into code execution

## What to do

1. Update or remove the affected component as soon as a fix exists.
2. If you cannot patch yet, disable the plugin and restrict access while you plan.
3. After any suspected RCE, assume compromise: scan, rotate secrets, hunt backdoors.
4. Keep file upload and capability checks honest in custom code so you do not invent your own RCE.