Critical WordPress Core Vulnerability wp2shell Leads to Unauthenticated Remote Code Execution Across Millions of Sites

The global cybersecurity landscape faced a significant tremor this week as details emerged regarding a critical vulnerability chain in WordPress core, dubbed wp2shell, which allows unauthenticated attackers to execute arbitrary code on affected servers. The vulnerability, which impacts the most recent versions of the world’s most popular content management system (CMS), has triggered an unprecedented response from the WordPress security team, including the deployment of forced automatic updates to millions of websites worldwide. As of July 18, 2026, the vulnerability has been fully documented, two distinct Common Vulnerabilities and Exposures (CVE) identifiers have been assigned, and a functional proof-of-concept (PoC) has been made available to the public, heightening the urgency for site administrators to verify their patch status.

The wp2shell exploit is not a single flaw but a sophisticated chain of two separate vulnerabilities discovered in the WordPress core architecture. The first component, identified as CVE-2026-63030, involves a logic flaw within the WordPress REST API batch-requesting framework. The second component, CVE-2026-60137, is a high-severity SQL injection vulnerability residing in the WP_Query class, a fundamental part of the WordPress codebase used to retrieve content from the database. When combined, these flaws allow a remote, anonymous user to bypass standard authentication checks and deliver a malicious payload directly to the database, eventually resulting in full remote code execution (RCE).

The Technical Mechanism of the wp2shell Chain

To understand the severity of wp2shell, one must look at the specific technical failures that allow the exploit to function. The chain begins with the REST API batch endpoint, located at /wp-json/batch/v1. This feature, which was introduced to WordPress core in version 5.6 in late 2020, was designed to improve performance by allowing developers to bundle multiple API requests into a single HTTP call. However, researchers discovered a "route confusion" error in how WordPress handles these bundled requests.

When a batch request is processed, WordPress tracks the individual sub-requests in parallel arrays. If one of these sub-requests encounters a specific type of error, the internal pointer for these arrays can become desynchronized. This misalignment causes a request intended for a public, low-privilege endpoint to be processed by a different, high-privilege handler. Effectively, the batch endpoint can be tricked into "misplacing" the authentication requirements of a request, allowing an anonymous user to access internal functions that should be restricted to administrators.

This routing confusion serves as the delivery vehicle for the second half of the attack: the SQL injection in WP_Query. The flaw is located specifically within the author__not_in parameter. In a standard operation, this parameter expects an array of author IDs to exclude from a search. However, the code fails to properly validate the input type. If an attacker provides a string instead of an array, the system skips the intended sanitization routine and inserts the raw string directly into the SQL query. By nesting this malformed request inside the confused batch route, an attacker can execute complex SQL commands, move laterally through the database, and eventually write a malicious PHP shell to the server’s file system.

Chronology of Discovery and Disclosure

The road to the current crisis began when Adam Kues, a researcher at Assetnote—the attack surface management division of Searchlight Cyber—identified the REST API batch-route flaw. Recognizing the potential for widespread exploitation, Kues reported the finding to the WordPress security team through their official bug bounty program on HackerOne.

As the WordPress security team investigated the batch-route confusion, a separate group of researchers, including individuals identified as TF1T, dtro, and haongo, independently discovered and reported the SQL injection vulnerability in the author__not_in parameter. It soon became clear to both the researchers and the core developers that these two bugs, while dangerous individually, represented a catastrophic threat when used in tandem.

The timeline of the response was rapid:

• Early July 2026: Researchers submit the vulnerabilities to WordPress via HackerOne.
• July 10, 2026: WordPress developers finalize patches for the 6.8, 6.9, and 7.0 branches.
• July 15, 2026: WordPress officially releases versions 6.9.5 and 7.0.2. Simultaneously, the "forced update" mechanism is triggered, pushing the patch to sites that have auto-updates enabled.
• July 16, 2026: Searchlight Cyber publishes a preliminary advisory under the name wp2shell, providing a web-based tool at wp2shell.com for administrators to check their vulnerability status without revealing the full exploit code.
• July 17, 2026: Independent researchers, having analyzed the public patches, successfully reconstruct the exploit. A functional proof-of-concept is uploaded to GitHub.
• July 18, 2026: Full technical write-ups are published across the cybersecurity community, and CVE IDs are formally assigned.

Scope of Impact and Affected Versions

The reach of wp2shell is determined by the specific version of WordPress a site is running. While the SQL injection flaw (CVE-2026-60137) is older, dating back to WordPress 6.8, it cannot be easily reached by unauthenticated users without the batch-route confusion (CVE-2026-63030). The batch-route flaw was only introduced in WordPress 6.9, which was released on December 2, 2025.

Consequently, the risk profile is divided as follows:

• WordPress 6.9 and 7.0: These versions are vulnerable to the full RCE chain. Any site running these versions without the latest security patches (6.9.5 or 7.0.2) is at risk of total compromise by an anonymous attacker.
• WordPress 6.8: This version is vulnerable to the SQL injection but lacks the specific batch-route flaw required for unauthenticated RCE. While the risk is lower, it remains significant, as an authenticated user (such as a contributor or subscriber) could still exploit the SQLi.
• WordPress 7.1 Beta: The upcoming 7.1 release was patched as of Beta 2, ensuring that early adopters moving toward the next major version are protected.

Searchlight Cyber estimates that while over 500 million websites utilize WordPress, the specific subset of sites running the vulnerable 6.9 and 7.0 branches represents the most immediate "blast radius." Given that version 6.9 has been available for approximately eight months, a substantial percentage of the active WordPress ecosystem is currently within the exploitation window.

Industry Reactions and Defensive Measures

The disclosure has prompted immediate action from major infrastructure providers. Cloudflare was among the first to respond, deploying specialized Web Application Firewall (WAF) rules to its global network to block attempts to exploit the batch/v1 endpoint. In its technical analysis, Cloudflare noted a crucial detail: the RCE path appears to be mitigated on sites utilizing a persistent object cache, such as Redis or Memcached. Because the exploit relies on specific database states and repeated queries, the presence of a persistent cache can break the timing or the data flow required for the shell to be written. However, Cloudflare warned that this is a "side effect of architecture" rather than a true fix, and the underlying SQL injection remains a threat.

Official bodies and security vendors are also adjusting their posture. Rapid7 announced that authenticated vulnerability scans for its InsightVM and Nexpose products would be updated by July 20 to detect the flaws. While the Cybersecurity and Infrastructure Security Agency (CISA) has not yet added wp2shell to its Known Exploited Vulnerabilities (KEV) catalog, experts suggest this is only a matter of time. The KEV catalog requires evidence of active exploitation in the wild, and with a public PoC now available, such reports are expected imminently.

The WordPress core team’s decision to use "forced updates" has also sparked discussion within the community. While this mechanism is reserved for the most dire security threats, it bypasses the standard administrative settings on many servers. WordPress has not explicitly confirmed whether these updates will reach sites that have manually disabled the WP_AUTO_UPDATE_CORE constant in their configuration files, leading experts to advise all administrators to manually verify their version numbers rather than assuming the patch was applied.

Broader Implications for CMS Security

The emergence of wp2shell highlights a recurring challenge in open-source software security: the "patch-as-a-map" problem. Because WordPress core is open source, every security patch provides a literal roadmap for attackers. By comparing the code of version 6.9.4 with 6.9.5, researchers can identify exactly which files were changed and deduce the nature of the vulnerability. In this instance, the "race" between the patch and the exploit was won by the attackers in less than 48 hours.

This event also draws comparisons to previous mass-exploitation campaigns, such as the 2026 "WP-SHELLSTORM" incident. In that case, a leak from a hacker-controlled server revealed that a single vulnerability in a popular caching plugin had been used to compromise over 17,000 sites. Unlike that incident, which targeted a third-party plugin, wp2shell targets the core software itself, meaning even a "vanilla" installation with no plugins and a default theme is vulnerable.

As the week progresses, the security community is watching the "update curve" closely. The success of the WordPress auto-update system will be tested against the speed of automated scanning bots that are now traversing the internet in search of unpatched /wp-json/batch/v1 endpoints. For site owners, the message is clear: the era of "set it and forget it" CMS management is over, and the speed of response is now the primary determinant of digital survival.

Administrators who are unable to update immediately are urged to implement temporary blocks on the REST API batch route through server-level configurations (such as .htaccess or Nginx rules) or to utilize a WAF to filter incoming JSON payloads. However, these are strictly stopgap measures. The only definitive resolution to the wp2shell threat is the application of the official security releases provided by the WordPress core team.