wp2shell WordPress Core RCE: CVEs Enable Unauthenticated Code Execution

A critical pair of vulnerabilities in WordPress Core, dubbed wp2shell, enables unauthenticated remote code execution on millions of websites. The flaws are tracked as CVE-2026-63030 and CVE-2026-60137. They were patched in WordPress 6.9.5 and 7.0.2 on July 17, 2026. Public proof-of-concept exploits are already circulating, and security firms report early signs of in-the-wild exploitation.

What Happened: wp2shell WordPress Core RCE Chained by Two Critical Flaws

On July 17, 2026, WordPress shipped emergency security releases 6.9.5 and 7.0.2 to fix a pre-authentication remote code execution chain dubbed wp2shell. The attack requires no plugins and works against a default WordPress install. Security researchers at Searchlight Cyber discovered the first flaw, while the SQL injection was reported separately by TF1T, dtro, and haongo.

The WordPress security team enabled forced automatic updates for affected sites. This is an unusual step, reflecting the severity of the threat. The two flaws must be chained together for full RCE. However, both now have public exploits available on GitHub, making immediate patching essential.

Security firm watchTowr has already observed signs of in-the-wild exploitation. Cloudflare deployed managed WAF rules for all plans, including free accounts, to block attack traffic while administrators patch. The vulnerable versions are WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. WordPress 6.8.x is affected by the SQL injection only, which cannot be chained to RCE.

Technical Details of the wp2shell Attack Chain

The wp2shell chain combines two independent vulnerabilities. Each is serious on its own. Together, they allow an anonymous HTTP request to execute arbitrary code.

CVE-2026-63030: REST API Batch-Route Confusion

The first flaw is a REST API batch-route confusion vulnerability introduced in WordPress 6.9. WordPress’s /wp-json/batch/v1 endpoint processes multiple sub-requests in a single call. It tracks them in two parallel arrays. When one sub-request errors, the arrays fall out of sync by one position. This causes a subsequent request to run under the wrong handler.

Consequently, an attacker can bypass the endpoint’s allow-list and route unauthenticated input into a privileged handler. The batch endpoint has existed since WordPress 5.6 in 2020. However, the specific confusion bug only appeared in WordPress 6.9.

CVE-2026-60137: SQL Injection in WP_Query

The second flaw is an SQL injection in the author__not_in parameter of WP_Query. When a string is passed instead of an array, the type check is skipped. The raw value is dropped directly into the SQL query. On its own, this is a high-severity data exposure flaw. Chained with the batch-route confusion, it becomes the stepping stone to code execution.

How the Chain Works

1. An attacker sends a crafted request to the /wp-json/batch/v1 endpoint.
2. The batch-route confusion routes the attacker’s input into the vulnerable WP_Query handler.
3. The SQL injection executes attacker-controlled SQL in the database.
4. Depending on the payload, the attacker can extract password hashes, escalate privileges, or achieve full remote code execution.

Some public exploits extract administrator password hashes, crack them, and then upload a malicious plugin. Others claim to achieve pre-authentication RCE without needing credentials.

One condition narrows the blast radius. Cloudflare notes that sites running a persistent object cache, such as Redis or Memcached, may be off the code-execution path. This is a side effect, not a fix. Default installs have no persistent cache, so they remain fully exposed.

Business and Operational Impact

The impact of wp2shell is potentially enormous. WordPress powers over 500 million websites globally. Even though the RCE chain only affects versions 6.9 and 7.0, that still represents a massive attack surface. The vulnerability is especially dangerous because it requires no authentication and no plugins.

• Immediate site takeover: Attackers can gain full control of affected WordPress installations.
• Data theft: Password hashes, user data, and database contents can be extracted via SQL injection.
• Supply-chain contamination: Compromised sites can be used to deliver malware to visitors.
• SEO and reputation damage: Hacked sites may be defaced or injected with spam, harming search rankings.
• Service disruption: Widespread exploitation could trigger emergency maintenance windows and downtime.

Furthermore, WordPress’s ubiquity means this vulnerability will be targeted by both sophisticated threat actors and automated exploit kits. The mass-exploitation industry around WordPress is well established. A recent caching-plugin flaw allowed one group to compromise over 17,000 sites. wp2shell is easier to exploit and works on default settings.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Update WordPress immediately. Upgrade to 6.9.5 or 7.0.2. Do not delay. If automatic updates are enabled, verify the patch has applied.
2. Verify your version. Do not assume the forced update reached your site. Check the WordPress admin dashboard or run wp core version via WP CLI.
3. Review access logs. Look for POST requests to /wp-json/batch/v1 or ?rest_route=/batch/v1 from unknown IPs.
4. Check for unauthorized users or plugins. If exploitation occurred before patching, attackers may have added backdoors.
5. Reset administrator credentials. As a precaution, force password resets for all admin-level accounts.

Temporary Mitigations

If you cannot patch immediately, use these stopgaps. They may break legitimate integrations that rely on the REST API batch endpoint:

• Block the batch endpoint at your WAF. Deny requests to /wp-json/batch/v1 and ?rest_route=/batch/v1. Both paths must be blocked. Cloudflare has deployed managed rules for this.
• Disable unauthenticated REST API access. Install a plugin that restricts anonymous REST API calls. This is a blunt instrument but effective.
• Implement network segmentation. Restrict external access to WordPress admin and REST endpoints where possible.

Bottom line: Patch now. The exploit is public, the attack surface is massive, and in-the-wild exploitation has already started. Temporary mitigations are exactly that — temporary. Only updating to a fixed version fully removes the risk.

Incident Summary

CVE ID / Incident:	CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WP_Query)
Affected Systems:	WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 (full RCE); WordPress 6.8.0–6.8.5 (SQL injection only)
Disclosure Date:	July 17, 2026
Patch Status:	Fixed in WordPress 6.9.5, 7.0.2, and 6.8.6. Forced auto-updates enabled for affected versions.
Severity:	Critical (WordPress advisory); CVE-2026-63030 scored 7.5 High; CVE-2026-60137 scored 9.1+ Critical
Exploitation:	Public proof-of-concept exploits available; early in-the-wild exploitation confirmed by watchTowr

References

1. Searchlight Cyber, “wp2shell: Pre-Authentication RCE in WordPress Core,” July 2026, https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core, accessed July 18, 2026.
2. WordPress.org, “WordPress 7.0.2 Release,” July 17, 2026, https://wordpress.org/news/2026/07/wordpress-7-0-2-release/, accessed July 18, 2026.
3. GitHub Advisory Database, “GHSA-ff9f-jf42-662q: REST API batch-route confusion in WordPress Core,” https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q, accessed July 18, 2026.
4. GitHub Advisory Database, “GHSA-fpp7-x2x2-2mjf: SQL injection in WP_Query author__not_in parameter,” https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf, accessed July 18, 2026.
5. Cloudflare, “WAF Protections for WordPress Vulnerabilities,” July 17, 2026, https://blog.cloudflare.com/wordpress-vulnerabilities/, accessed July 18, 2026.
6. BleepingComputer, “WordPress Core ‘wp2shell’ RCE flaws get public exploits, patch now,” July 18, 2026, https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/, accessed July 18, 2026.
7. The Hacker News, “New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code,” July 17, 2026, https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html, accessed July 18, 2026.