Critical 'wp2shell' RCE Vulnerability Strikes WordPress Core: Immediate Patching Urged for Developers

The 'wp2shell' vulnerability isn't a single flaw but a chain of two distinct bugs that, when exploited together, grant an anonymous attacker the ability to execute arbitrary code on a vulnerable WordPress site. These vulnerabilities have been assigned CVE IDs: CVE-2026-63030 and CVE-2026-60137.

The first component, CVE-2026-63030, is a REST API batch-route confusion bug. This flaw resides within WordPress's REST API, which is integral to how the platform handles various operations, especially in modern WordPress development with block editors and headless architectures. Attackers could manipulate how the REST API processes batch requests, leading to unexpected behavior and opening a door for further exploitation.

The second, equally critical component is CVE-2026-60137, a SQL injection vulnerability found directly in WordPress core. SQL injection flaws allow attackers to interfere with the queries an application makes to its database. By injecting malicious SQL code, an attacker can trick the database into executing commands that were not intended, potentially leading to data exfiltration, modification, or, in this case, paving the way for remote code execution.

The combination of these two vulnerabilities is particularly dangerous because it requires no authentication. An anonymous HTTP request is sufficient to trigger the exploit chain, making a bare WordPress installation with zero plugins exploitable. This means that even newly installed sites or those with minimal configurations were at risk until the patches were applied.

Remote Code Execution (RCE) is one of the most severe types of vulnerabilities, as it allows an attacker to run arbitrary code on a target system. In the context of 'wp2shell,' this means an attacker could gain full control over a compromised WordPress site. With RCE, an attacker could:

• Install backdoors to maintain persistent access.
• Deface the website or inject malicious content.
• Steal sensitive data, including user credentials, customer information, or proprietary business data.
• Use the compromised server to launch further attacks, such as phishing campaigns or malware distribution.
• Completely wipe the website and its database.

The fact that this exploit requires no prior authentication and targets the core of WordPress makes it exceptionally dangerous. It bypasses common security measures that rely on user roles or plugin-based protections. WordPress versions 6.9 and 7.0 were specifically identified as vulnerable until the release of the patches.

The discovery of the batch-route bug was credited to Adam Kues at Assetnote, Searchlight Cyber's attack surface management arm, who reported it through WordPress's HackerOne program. The SQL injection was reported separately by TF1T, dtro, and haongo.

Recognizing the severity of the 'wp2shell' flaw, the WordPress security team acted swiftly. On July 17, 2026, WordPress released emergency updates:

• WordPress 6.9.5
• WordPress 7.0.2

These versions contain the necessary fixes to address both CVE-2026-63030 and CVE-2026-60137. Crucially, WordPress also enabled its auto-update system to force these updates, ensuring that a significant portion of vulnerable sites would be automatically secured. This proactive measure is vital for widespread platforms like WordPress, where many users might not manually update immediately.

However, even with forced updates, it's essential for developers and administrators to verify that their sites have indeed been patched. Factors like server configurations, hosting provider policies, or specific site setups might interfere with automatic updates. Furthermore, a working proof-of-concept (PoC) for the 'wp2shell' exploit has been made public on GitHub since July 17, 2026, increasing the urgency for all remaining unpatched sites.

For all developers and administrators managing WordPress sites, immediate action is non-negotiable. Here’s a checklist of critical steps:

1. Verify Your WordPress Version: Log into your WordPress dashboard and navigate to 'Dashboard' -> 'Updates' to confirm your current version. Ensure it is at least 6.9.5 or 7.0.2.
2. Update Immediately: If your site has not automatically updated, initiate a manual update to the latest stable version (6.9.5 or 7.0.2, or newer). Always back up your site before performing any major updates.
3. Check for Indicators of Compromise (IoCs): Given that a PoC is public, it's prudent to check your site's logs (web server logs, WordPress debug logs) for any suspicious activity around July 17-18, 2026. Look for unusual requests to the REST API or unexpected file modifications.
4. Review File Integrity: Use a file integrity monitoring tool or manually check core WordPress files for any unauthorized changes. Compare checksums against fresh WordPress installations.
5. Update Plugins and Themes: While 'wp2shell' is a core vulnerability, keeping all plugins and themes updated is a fundamental security practice.
6. Implement Web Application Firewall (WAF): A WAF can provide an additional layer of defense by filtering malicious traffic before it reaches your WordPress application, potentially blocking known exploit patterns.
7. Educate Your Team: Ensure everyone involved in managing WordPress sites is aware of this critical vulnerability and the importance of timely updates.

The rapid disclosure and public PoC mean that threat actors are likely actively scanning for and exploiting unpatched sites. Proactive security measures are the best defense against such high-impact vulnerabilities.