WordPress Core Faces Critical RCE Vulnerability: wp2shell Exposes Millions of Sites to Anonymous Code Execution

An anonymous HTTP request can now execute code on a WordPress site, thanks to a critical vulnerability residing within the platform’s core. This flaw, dubbed "wp2shell," affects a wide range of WordPress installations, including those with no plugins installed, making a bare installation exploitable. The vulnerability impacted all WordPress sites running versions 6.9 and 7.0 prior to Friday, July 17, 2026, when WordPress released emergency patches, versions 6.9.5 and 7.0.2, and activated its forced update mechanism to push these fixes to vulnerable sites.

wp2shell: A Chained Exploit for Unauthenticated Remote Code Execution

The wp2shell vulnerability is not a singular bug but rather a dangerous combination of two distinct security flaws that, when chained together, allow an unauthenticated attacker to achieve Remote Code Execution (RCE). The first component, identified as CVE-2026-63030, is a confusion within the REST API’s batch routing functionality. The second, CVE-2026-60137, is a SQL injection vulnerability found directly within WordPress core. Together, these vulnerabilities enable an anonymous user to execute arbitrary code on a target WordPress server.

The full technical details of this exploit chain have been published, and a working proof-of-concept (PoC) is now publicly available on GitHub. This rapid dissemination of exploit information underscores the urgency with which WordPress site owners needed to apply the available patches.

Discovery and Disclosure Timeline

The discovery of the batch-route confusion (CVE-2026-63030) is attributed to Adam Kues, a researcher with Assetnote, the attack surface management division of Searchlight Cyber. Kues reported this vulnerability through WordPress’s established HackerOne bug bounty program. The findings were later detailed in a technical write-up published under the name "wp2shell," highlighting the attack’s "no preconditions and can be exploited by an anonymous user" nature.

The SQL injection vulnerability (CVE-2026-60137) was reported separately by a trio of researchers: TF1T, dtro, and haongo. The coordinated disclosure of these two distinct but complementary vulnerabilities created a significant threat landscape for WordPress users.

While Searchlight Cyber maintained its own in-depth technical analysis, initially withholding certain details, the broader disclosure and the public availability of a proof-of-concept rendered this reticence largely moot. The critical information—the existence of the vulnerabilities and the method to exploit them—was already in the hands of the security community and potentially malicious actors.

Vulnerability Scope and Affected Versions

The two components of the wp2shell exploit affect different versions of WordPress, creating a nuanced picture of the affected user base.

• SQL Injection (CVE-2026-60137): This vulnerability has a broader reach, with its roots tracing back to WordPress version 6.8. This means that any site running version 6.8 or later, without the necessary patch, was susceptible to this specific SQL injection.
• REST API Batch-Route Confusion (CVE-2026-63030): This component, which elevates the SQL injection to a full RCE, is specific to newer versions of WordPress. It was introduced in version 6.9 and therefore impacts sites running 6.9 and later.

This version split is crucial for understanding the precise threat:

• WordPress 6.8.x: Sites running version 6.8.6 were patched against the SQL injection vulnerability alone. While not susceptible to the full RCE chain, they remained vulnerable to the SQL injection component if not updated to the latest 6.8 patch.
• WordPress 6.9.x and 7.0.x: Sites running these versions were susceptible to the full wp2shell exploit chain, combining both the SQL injection and the batch-route confusion. These were the primary targets for the unauthenticated RCE.

WordPress version 7.1 beta2 was confirmed to include fixes for both vulnerabilities. The urgency of the situation was compounded by WordPress’s decision to implement forced updates, a measure typically reserved for critical security issues. The platform’s auto-update system was leveraged to push the patches to a vast number of installations. However, questions remain about whether this forced push successfully reached sites where users had explicitly disabled automatic updates. Website administrators are strongly advised to verify their current WordPress version rather than assuming the patch has been applied automatically.

Technical Deep Dive: Exploitation Mechanics

The wp2shell exploit chain leverages two specific weaknesses within WordPress’s architecture.

1. The SQL Injection in WP_Query: The SQL injection flaw resides within the WP_Query class, specifically in how it handles the author__not_in parameter. The vulnerability is triggered when this parameter is provided with a string value instead of the expected array. This deviation bypasses a critical validation check, allowing the raw string input to be directly incorporated into the SQL query. This manipulation can lead to unauthorized data access and modification within the WordPress database.

2. The REST API Batch Endpoint Confusion: The second piece of the puzzle is the REST API’s batch endpoint, introduced in WordPress 5.6 in November 2020. This endpoint is designed to allow multiple sub-requests to be processed within a single HTTP request, improving efficiency. It manages these sub-requests using two parallel arrays. The critical flaw here is an error condition that can cause these arrays to fall out of synchronization by one position. When this happens, a sub-request might be processed by an unintended handler.

When combined, the unauthenticated attacker first targets the REST API’s /wp-json/batch/v1 route. By crafting a malicious request that exploits the array desynchronization, the attacker can steer their input to bypass the endpoint’s allow-list and reach the vulnerable author__not_in parameter of the WP_Query class. This bypass of authentication and authorization controls is what elevates the SQL injection to a full-blown RCE. The batch endpoint itself has been a feature for years, but the specific confusion that abuses it is a new development in version 6.9.

Impact and Reach of the Vulnerability

Estimates suggest that over 500 million websites globally utilize the WordPress content management system. While this figure represents the total install base, the number of sites actually exposed to the RCE chain is more limited, though still substantial. The RCE exploit path, which requires the batch-route confusion, is only present in WordPress versions 6.9 and later. WordPress 6.9 was released on December 2, 2025. Therefore, any site vulnerable to the full RCE was running a version released less than eight months prior to the patch. The exact number of sites running these specific vulnerable versions remains undisclosed by WordPress.

CVE Scores and Discrepancies

The severity of the wp2shell vulnerability has been reflected in its official Common Vulnerabilities and Exposures (CVE) scores, though there have been some notable discrepancies that warrant attention.

WordPress’s internal security advisory for this RCE chain rated it as "Critical." However, the official CVE record assigned a CVSS score of 7.5, classifying it as "High." The impact metrics for this score primarily credited data access, potentially overlooking the full extent of integrity and availability loss that typically accompanies code execution.

The SQL injection component, on its own, received a higher CVSS score, exceeding 9.1, also classified as "Critical." This scoring anomaly highlights a potential underestimation of the RCE’s immediate threat in the official CVE record. Security professionals are advised to track both CVEs independently, recognizing that the "Critical RCE" label, while impactful, might be overshadowed by the more severe direct database access implications of the SQL injection itself when considered in isolation.

Persistent Object Cache: A Conditional Mitigation

One significant factor that narrows the blast radius of the RCE component is the presence of a persistent object cache. According to Cloudflare, which released Web Application Firewall (WAF) rules in conjunction with the disclosure, the code execution path is only viable when a site is not running a persistent object cache.

A default WordPress installation typically does not include a persistent object cache, meaning these sites were fully exposed to the RCE. However, sites that front their WordPress instance with caching solutions like Redis or Memcached might be insulated from this specific RCE exploit. It is crucial to understand that this is a conditional mitigation and not a complete fix. The underlying SQL injection vulnerability remains, regardless of object caching.

Official Responses and Industry Reactions

WordPress, recognizing the severity of the wp2shell vulnerabilities, acted swiftly. The release of versions 6.9.5 and 7.0.2, coupled with the activation of forced auto-updates, demonstrates a commitment to mitigating the immediate threat. The platform’s official advisory and subsequent CVE assignments provided the technical community with the necessary information to identify and address the vulnerabilities.

Searchlight Cyber, through its attack surface management arm Assetnote, played a pivotal role in identifying and reporting the batch-route confusion. Their detailed write-up, while initially withholding some technical specifics, clearly articulated the exploit’s pre-authentication nature.

Cloudflare’s proactive release of WAF rules aimed to provide an immediate layer of defense for websites that might not have yet applied the core WordPress patches. Their analysis of the persistent object cache condition offered a partial understanding of which sites might be less immediately vulnerable to the RCE.

Broader Implications and Future Outlook

The wp2shell vulnerability serves as a stark reminder of the ongoing challenges in securing the vast WordPress ecosystem. With hundreds of millions of websites relying on this platform, even seemingly minor flaws can have widespread consequences. The rapid weaponization of such vulnerabilities, evidenced by the public availability of proofs-of-concept, necessitates a constant state of vigilance and rapid patching.

The incident also highlights the effectiveness of bug bounty programs like HackerOne in incentivizing responsible disclosure. However, it also underscores the race against time between the patching of a vulnerability and its exploitation. As WordPress core is open-source, the release notes for patches often reveal the nature of the fixes, providing a roadmap for malicious actors.

The fact that the RCE exploit works on a default installation, without requiring any additional plugins or complex configurations, significantly broadens its potential impact. This contrasts with some previous WordPress vulnerabilities that were only exploitable under specific, non-default conditions.

As of July 18, 2026, the vulnerability had not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, which requires confirmed exploitation in the wild. Furthermore, no public reports of exploitation had surfaced. However, this lack of immediate public reporting does not diminish the threat. The ease with which the exploit can be deployed, especially with a public PoC, suggests that it is only a matter of time before widespread exploitation occurs, if it has not already begun covertly. Security scanners like Rapid7’s InsightVM and Nexpose were expected to include authenticated checks for this vulnerability by July 20, 2026, providing organizations with tools to identify their exposure.

Mitigation Strategies for Unpatched Sites

For organizations unable to update their WordPress installation immediately, Searchlight Cyber has outlined several temporary mitigation strategies. These measures primarily focus on restricting access to the vulnerable batch endpoint, thereby disrupting the exploit chain. However, it is crucial to note that these are stopgap solutions and can potentially interfere with legitimate website functionality or integrations.

• Blocking Access to the Batch Endpoint: The most direct mitigation involves blocking requests to the /wp-json/batch/v1 endpoint at the web server level (e.g., via .htaccess or Nginx configuration). This prevents attackers from initiating the exploit chain.
• Web Application Firewall (WAF) Rules: Implementing WAF rules specifically designed to detect and block the patterns associated with the wp2shell exploit can provide an additional layer of defense.
• Rate Limiting: Applying strict rate limiting to the REST API, particularly the batch endpoint, can help mitigate brute-force attempts and slow down automated exploitation.

These measures are temporary workarounds and should not be considered a substitute for applying the official WordPress security updates. The long-term security of any WordPress site hinges on maintaining an up-to-date core, themes, and plugins.

The wp2shell vulnerability represents a significant security event for the WordPress community. The combination of a critical RCE flaw, its presence in core, and the rapid public availability of exploit details underscores the persistent challenges of web application security. The swift response from WordPress, including forced updates, was a necessary measure to contain the immediate threat. However, the ongoing vigilance of website administrators in applying patches and monitoring for suspicious activity remains paramount in safeguarding against future exploits. The speed at which vulnerabilities are discovered, weaponized, and patched will continue to define the security landscape for platforms like WordPress.