WordPress wp2shell Vulnerability: Critical RCE Alert and Complete Patch Guide

A critical vulnerability chain disclosed in July 2026, designated wp2shell, allows an anonymous attacker to execute arbitrary code on any unpatched WordPress installation running versions 6.9.0 through 7.0.1. No credentials are required. No plugins need to be installed. A clean, default WordPress core installation on an affected version is fully exploitable by any anonymous HTTP request. We are covering this immediately because the scope of exposure, over 500 million websites globally, makes wp2shell one of the most significant WordPress security events in the platform’s history.

🚨 Action Required: If your site runs WordPress 6.9.0 to 6.9.4, update to 6.9.5 now. If your site runs WordPress 7.0.0 or 7.0.1, update to 7.0.2 now. Do not wait.

For context on what changed in WordPress 7.0 before this vulnerability emerged, read our guide on WordPress 7.0 features. For foundational security practices every WordPress site owner should have in place, see our WordPress security basics guide.

TL;DR: What You Need to Know Right Now

• What: A two-CVE chain (CVE-2026-63030 + CVE-2026-60137) enables unauthenticated remote code execution on WordPress core.
• Who is affected: WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1.
• Scale: WordPress powers 43% of all websites globally. Over 500 million sites sit on this platform.
• Public exploits: Proof-of-concept exploit code is publicly available. Automated scanning for vulnerable sites is already occurring.
• Fix: Update to WordPress 6.9.5 or 7.0.2 immediately. WordPress has enabled forced auto-updates for supported affected installations.
• Temporary measures: Block the /wp-json/batch/v1 endpoint at WAF level if you cannot patch immediately.

Understanding the wp2shell Vulnerability Chain

wp2shell is not a single flaw. It is a two-vulnerability chain that only becomes critical when both components work together. Understanding each component explains why this combination earned emergency status.

CVE-2026-63030: REST API Batch-Route Confusion

This vulnerability was introduced in WordPress 6.9 through a logic error in how the WordPress REST API batch endpoint processes multiple simultaneous requests. The batch endpoint at /wp-json/batch/v1 was designed to allow developers to send multiple API requests in a single HTTP call for performance efficiency.

The flaw causes a request object to be evaluated against the wrong permission check during batch processing. Specifically, an anonymous request can be structured so that the permission validation runs against a different request than the one that ultimately executes. The result is that code execution happens under an incorrectly validated permission context, bypassing authentication entirely.

This flaw exists only in WordPress 6.9.0 and later. Versions prior to 6.9 do not contain the batch-route logic and are therefore not vulnerable to the full wp2shell chain.

CVE-2026-60137: SQL Injection in WP_Query

This second component is a high-severity SQL injection vulnerability in the author__not_in parameter of the WP_Query class, one of the most fundamental database query mechanisms in WordPress. The flaw affects WordPress 6.8.0 through 7.0.1.

SQL injection in WP_Query is particularly dangerous because WP_Query underlies an enormous proportion of WordPress’s database interactions. Every post loop, custom query, and dynamic archive page that developers build typically uses WP_Query. An injectable parameter at this level means database access is not the only risk. Under certain server configurations, SQL injection through WP_Query can escalate to file system access and code execution through database functions.

The Chain: Why Two Medium Flaws Become Critical Together

Neither vulnerability alone achieves unauthenticated remote code execution. CVE-2026-60137 requires reaching the vulnerable WP_Query parameter, which normally requires some form of authenticated access. CVE-2026-63030 provides the authentication bypass that makes CVE-2026-60137 reachable anonymously.

Together, an anonymous attacker sends a crafted batch request to /wp-json/batch/v1. The batch-route confusion bypass carries that request past WordPress’s permission check. The manipulated request then reaches the SQL injection point in WP_Query. From there, depending on server configuration and MySQL permissions, full remote code execution on the web server becomes achievable.

Adam Kues of Searchlight Cyber (formerly Assetnote) discovered and responsibly disclosed this chain to the WordPress Security Team before going public, giving administrators time to patch before technical details reached the public. That disclosure window has now closed. BleepingComputer confirmed that public proof-of-concept exploit code is now available, meaning automated exploitation of unpatched sites is an active risk today.

ℹ️ Note: The CVE-2026-60137 SQL injection component affects WordPress 6.8.0 through 6.8.5 as a standalone high-severity vulnerability even without the batch-route confusion chain. Sites on WordPress 6.8.x should also apply the available security update for their branch. However, the full unauthenticated RCE chain requires 6.9.0 or later.

The Scale of Exposure: Why This Vulnerability Is Category-Defining

Most WordPress security vulnerabilities target third-party plugins or themes. The majority of the plugin ecosystem’s 60,000-plus plugins serve small audiences, limiting any individual plugin vulnerability’s maximum blast radius. wp2shell operates at the core level, which changes the exposure mathematics entirely.

The numbers above illustrate why security researchers are treating wp2shell with category-defining urgency. CyberInsider’s reporting on the emergency update confirmed that WordPress enabled forced automatic security updates for supported affected installations, a measure the WordPress.org team reserves for the most severe security events.

For comparison, the widely publicised Magento RCE in 2022 affected roughly 250,000 sites. The Drupalgeddon vulnerability in 2018 affected sites running about 1% of the web. wp2shell’s theoretical maximum exposure is over 200 times larger than Drupalgeddon by site count.

The shared hosting dimension amplifies the risk further. A significant proportion of WordPress sites run on shared hosting environments where multiple sites share the same physical server resources. A successful wp2shell exploit on one site on a shared host creates a potential pivot point to other sites on the same server, depending on how the hosting provider has isolated file system permissions between accounts.

Are You Vulnerable? How to Check

Confirming your WordPress version takes under thirty seconds. Log into your WordPress admin dashboard and check the version number displayed in the footer of any admin screen or in the At a Glance widget on the dashboard homepage. Alternatively, access wp-includes/version.php directly on your server or open readme.html in your WordPress root directory.

You are vulnerable if your version falls into either of these ranges:

• WordPress 6.9.0 through 6.9.4 — Full RCE chain exploitable
• WordPress 7.0.0 through 7.0.1 — Full RCE chain exploitable
• WordPress 6.8.0 through 6.8.5 — SQL injection component only, no full RCE chain

Searchlight Cyber has released a public checker at wp2shell.com that allows administrators to test a WordPress installation’s vulnerability status against this specific threat. We recommend using this after updating to confirm the patch applied correctly.

Help Net Security’s detailed technical breakdown of both CVEs provides additional verification methodology for administrators who need to document their remediation for compliance purposes.

How to Patch: Step-by-Step

The only complete fix for wp2shell is updating to a patched WordPress version. Temporary mitigations exist but leave your site at partial risk. Patching eliminates the vulnerability entirely.

Step 1: Back Up Before Anything

Create a full backup of your WordPress files and database before touching any update. This is non-negotiable. If an update introduces any compatibility issue with your specific plugin or theme configuration, you need a restore point. Use Duplicator, UpdraftPlus, or your host’s backup tool and store the backup off-server.

For a detailed walkthrough of safely updating WordPress core including backup procedures, read our guide on how to update WordPress core safely.

Step 2: Update via the WordPress Dashboard

Navigate to Dashboard then Updates in your WordPress admin area. If the forced auto-update has not yet applied, a prompt to update to 6.9.5 or 7.0.2 will appear. Click Update Now and allow the process to complete. The update typically takes under sixty seconds on most hosting environments.

Step 3: Verify the Update Applied

After updating, confirm your WordPress version number in the dashboard footer or At a Glance widget. Run the Searchlight Cyber checker at wp2shell.com to validate your installation’s patch status independently. Do not assume the update succeeded without verifying the version number directly.

Step 4: Check Managed Sites and Subsites

If you manage WordPress Multisite networks, agency client portfolios, or staging environments, each installation requires individual verification. WordPress’s forced auto-update applies to supported installations but does not guarantee every managed environment updated successfully. Check every site you are responsible for.

Temporary Mitigations If You Cannot Patch Immediately

Patching is the only complete solution. If a business process, hosting restriction, or compatibility concern prevents immediate patching, these temporary measures disrupt the primary attack vector. Treat them as emergency cover only, not as a permanent security posture.

Block the batch endpoint at WAF level: Add rules to your Web Application Firewall to block all anonymous requests to /wp-json/batch/v1 and ?rest_route=/batch/v1. This eliminates the batch-route confusion entry point. Most major WAF providers including Cloudflare, Sucuri, and Wordfence released specific wp2shell rules within hours of the public disclosure.

Deploy Searchlight Cyber’s emergency plugin: Searchlight Cyber released a PHP code snippet that functions as an emergency hotfix plugin. Save the code as a .php file, upload it to wp-content/plugins/, and activate it from the Plugins dashboard. This intercepts and rejects unauthenticated requests to the batch endpoint at the WordPress application layer.

Block anonymous REST API access entirely: Security plugins including Wordfence and iThemes Security include options to disable anonymous REST API access. This is a more aggressive measure that may affect legitimate functionality on sites using the REST API for public-facing features.

💡 Pro Tip: Even after applying temporary mitigations, set a hard deadline of no longer than 48 hours to apply the full patch. WAF rules and plugin-level blocks are bypass-prone under sophisticated exploitation. The patch eliminates the vulnerability. Everything else reduces it.

What Attackers Can Do With a Successful wp2shell Exploit

Understanding what a successful exploit enables helps site owners communicate the risk to stakeholders and prioritise remediation speed appropriately.

Full database access gives attackers all user credentials stored in your WordPress database. On sites not enforcing bcrypt or stronger password hashing, those credentials may be recoverable. User email addresses, phone numbers, order histories, and any other data your site collects sits exposed. For sites processing payments or holding membership data, this represents a reportable data breach under GDPR, CCPA, and equivalent regulations.

File system write access allows attackers to install backdoors that persist even after a WordPress update. A webshell planted in wp-content/uploads/ or injected into a theme file continues to operate after patching unless explicitly removed. This is why security teams recommend a full malware scan alongside the patch on any site that may have been exposed to attack attempts before the update applied.

Server pivot potential exists on shared hosting environments. Depending on file permission configurations, a compromised WordPress installation may provide access to adjacent sites sharing the same server account or physical machine.

For ongoing hardening beyond wp2shell, our complete WordPress security basics guide covers the foundational measures every site should maintain between security events.

Long-Term WordPress Security Hardening

wp2shell is a core vulnerability, which means no plugin configuration and no theme choice prevented exposure on affected versions. The only protection was version currency. This reality makes the long-term security posture lesson clear: automatic updates must stay active, backup verification must be routine, and WAF protection must operate continuously rather than reactively.

Enable automatic background updates for WordPress core in wp-config.php by adding define('WP_AUTO_UPDATE_CORE', true); if your hosting environment supports it. Most managed WordPress hosts enable this by default, which explains why managed hosting customers typically received the wp2shell patch within hours rather than days.

Run a security plugin that monitors file integrity and flags changes to core WordPress files. Wordfence, Solid Security, and Sucuri Security all offer file integrity monitoring that would flag a webshell planted after a successful exploit. Detecting a compromise early dramatically reduces recovery complexity and data exposure duration.

Review database user privileges on your MySQL server. WordPress requires only SELECT, INSERT, UPDATE, and DELETE privileges for normal operation. Removing FILE privilege from the MySQL user WordPress connects with limits the blast radius of any future SQL injection vulnerability to data access rather than file system access.

Additional Resources

• WordPress Security Basics: Complete Protection Guide
• How to Update WordPress Core Safely
• WordPress 7.0 Features: Everything That Changed
• WordPress Releases Emergency Update for Critical wp2shell RCE Flaw (CyberInsider)
• Two New High Severity WordPress Vulnerabilities: Patch Immediately (Help Net Security)
• WordPress Core wp2shell RCE Flaws Get Public Exploits, Patch Now (BleepingComputer)

We will continue monitoring the wp2shell situation and update this article as new information emerges. The single most important action is updating to WordPress 6.9.5 or 7.0.2 right now. Every hour of delay on an unpatched site with public exploit code in circulation increases exposure risk. Back up, update, verify, and harden.