WordPress has faced another serious security crisis, and this one is especially alarming because it targets the core software itself. A vulnerability chain nicknamed WP2Shell allows an unauthenticated attacker to move from zero access to full site takeover on affected WordPress installations. For site owners, agencies, and publishers, this is not just a technical issue. It is a business risk, a reputation risk, and a user trust crisis all at once.
We are covering this immediately. Our full technical breakdown of the emergency update is available at WordPress releases emergency update for the critical wp2shell RCE flaw. For foundational protection measures every WordPress site should have active right now, read our WordPress security basics guide.
🚨 Immediate Action Required: Update to WordPress 6.8.6, 6.9.5, or 7.0.2 right now. Do not assume auto-updates handled this. Verify your version in the dashboard directly.
TL;DR: WP2Shell in 60 Seconds
- What it is: A two-CVE chain in WordPress core enabling unauthenticated remote code execution.
- Who is affected: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. WordPress 6.8.6, 6.9.5, and 7.0.2 are patched.
- How serious: CVSS 9.8 Critical. No credentials, no plugins, no configuration required to exploit.
- Public exploits: Active exploitation began within hours of disclosure. Automated scanning is ongoing.
- Fix: Update immediately. Verify the version. Review admin accounts and file changes.
The Scale of This Problem: WordPress Hacking by the Numbers
To understand why WP2Shell earned emergency status from the WordPress.org security team, the numbers below put the risk in context. These figures cover both the specific wp2shell exposure and the broader reality of WordPress attack frequency that site owners need to understand.
The 97% statistic above is the most important one for context. Most successful WordPress attacks exploit known vulnerabilities that patches already exist for. wp2shell fits this pattern exactly: patched versions are available, and sites running unpatched versions remain fully exposed to automated scanning and exploitation that is already active.
What Is WP2Shell?
WP2Shell is the name security researchers assigned to a chained attack in WordPress core combining two distinct vulnerabilities. Neither flaw alone achieves full site takeover. Together, they provide an unauthenticated path to remote code execution on any vulnerable WordPress installation.
CVE-2026-63030 — REST API Batch-Route Confusion: This logic error in WordPress 6.9 affects how the REST API batch endpoint processes multiple simultaneous requests. An attacker crafts a request that passes permission validation against the wrong context, slipping past authentication entirely.
CVE-2026-60137 — SQL Injection in WP_Query: A high-severity injection flaw in the author__not_in parameter of WP_Query, the fundamental database query mechanism WordPress uses across virtually every page load. This affects WordPress 6.8.0 through 7.0.1.
CVE-2026-63030 delivers the attacker past the authentication gate. CVE-2026-60137 then executes under the wrongly validated context, escalating to full remote code execution. Security researchers at Akamai and Eye Security confirmed the chain. Adam Kues of Searchlight Cyber discovered and responsibly disclosed both flaws to the WordPress Security Team before public release.
ℹ️ Note: The SQL injection component affects WordPress 6.8.0 through 6.8.5 as a standalone high-severity flaw. The full RCE chain requires the batch-route confusion introduced in 6.9.0. Sites on 6.8.x should apply the 6.8.6 security update even though they face a different risk profile than 6.9.x and 7.0.x installations.
What Attackers Can Do Once Inside
A successful wp2shell exploit does not just give attackers a peek at your database. It hands them the keys to everything the WordPress application layer can touch. Security researchers and Malwarebytes’ analysis of compromised sites document these common post-exploitation actions:
- Creating rogue administrator accounts that persist even after the original vulnerability is patched.
- Reading or modifying the entire database, including all user credentials, order data, and personal information.
- Injecting malicious JavaScript into pages, turning your site into a credential-harvesting or malware delivery platform for your visitors.
- Installing plugins that run arbitrary system commands on the underlying server.
- Planting webshells in writable directories that survive a WordPress update and provide persistent server access.
For sites on shared hosting, the blast radius extends beyond your own installation. A compromised account on a shared server creates potential pivot access to neighbouring sites sharing the same server resources, depending on how the host has isolated file system permissions between accounts.
What Your Visitors Face on a Compromised Site
Malwarebytes published a specific analysis of what happens to visitors who land on a WordPress site compromised through wp2shell. The findings are worth understanding because the damage extends well beyond your own systems.
Visitors to compromised sites report encountering fake login pages mimicking Google, Microsoft 365, banking platforms, and social media networks, all designed to harvest credentials. Silent redirects send visitors to fraudulent or malicious destinations without any visible warning. Drive-by malware downloads disguise themselves as browser updates or document files. Browser fingerprinting scripts profile visitors silently for advertising fraud or targeted attack preparation.
From an SEO perspective, the damage compounds over time. Search engines flag sites serving malicious content, reducing organic click-through rates and suppressing rankings. Google Search Console surfaces security warnings. The spammy content attackers inject into indexed pages can result in sitewide rank drops that persist for months after cleanup. A hacked site can lower lead quality, increase bounce rates, and drive long-term trust damage that outlasts the original compromise by a significant margin.
Who Is Affected and What to Update To
WordPress has enabled forced automatic security updates for supported installations running affected versions. Do not assume this background update completed on every site you manage. Verify the installed version directly in the WordPress admin footer or in wp-includes/version.php for each installation.
Immediate Response Checklist
For agencies managing multiple client sites, treat this as an emergency maintenance event. Each installation requires individual version verification and update confirmation. A centrally managed WordPress dashboard or MainWP setup speeds this significantly across large portfolios.
If You Cannot Patch Immediately
Patching is the only complete solution. If a temporary blocker prevents immediate updating, these measures disrupt the primary attack vector as emergency cover.
Block the batch endpoint at WAF level: Add rules blocking all anonymous requests to /wp-json/batch/v1 and ?rest_route=/batch/v1. Cloudflare, Wordfence, and Sucuri all released wp2shell-specific rules within hours of the public disclosure. Apply them immediately.
Deploy Searchlight Cyber’s emergency plugin: A PHP code snippet functioning as a hotfix plugin is available from Searchlight Cyber. Upload it to wp-content/plugins/ and activate it. This intercepts unauthenticated requests to the batch endpoint at the application layer.
These are 48-hour measures only. WAF rules and plugin-level blocks do not eliminate the underlying vulnerability. Apply the core update as the first action you take when the blocker clears.
💡 Pro Tip: If your site runs on HTTPS with a properly configured SSL certificate, your TLS layer does not protect against wp2shell. The attack targets the application layer, not the transport layer. However, maintaining a valid SSL certificate is still a foundational security requirement. Our guide on how to install an SSL certificate on WordPress covers the setup if your site is still running on HTTP.
The Broader WordPress Security Context
wp2shell is a core vulnerability, which changes the calculus every WordPress site owner needs to apply to their security posture. Plugin vulnerabilities, which make up the majority of WordPress security incidents, can be addressed by removing or replacing a specific plugin. Core vulnerabilities have no such workaround. The platform itself is the attack surface.
The 52% statistic in the figures above, that more than half of successfully hacked WordPress sites in 2025 were running outdated core at the time of compromise, makes the long-term lesson clear. Auto-updates exist but do not guarantee every managed site updates on schedule. Manual version verification needs to be a routine part of any WordPress maintenance workflow, not just a response to specific incidents.
Comprehensive protection against the class of attacks wp2shell represents requires layers: current software versions, a web application firewall, file integrity monitoring, regular backups stored off-server, and SSL-secured connections throughout. Our complete WordPress security basics guide covers each of these layers with implementation steps for every skill level.
Additional Resources
- WordPress Emergency Update: Critical wp2shell RCE Flaw (CreatePressHub)
- WordPress Security Basics: Complete Protection Guide
- How to Install an SSL Certificate on WordPress
- WordPress Releases Emergency Update for Critical wp2shell RCE Flaw (CyberInsider)
- Two New High Severity WordPress Vulnerabilities: Patch Immediately (Help Net Security)
- WordPress Core wp2shell RCE Flaws Get Public Exploits, Patch Now (BleepingComputer)
- 10 Essential WordPress Settings (Fix These First!)
We will update this article as new information on wp2shell exploitation patterns and affected version scope emerges. The single most important action right now is verifying your WordPress version and applying the patch if you are running 6.9.0 to 6.9.4 or 7.0.0 to 7.0.1. Every hour of delay on an unpatched site with active public exploit code in circulation increases your risk of compromise. Back up, update, verify, and harden.
