WordPress has released security updates to address the wp2shell vulnerability, a critical flaw that allowed attackers to achieve remote code execution (RCE) on vulnerable sites using a single anonymous web request.
Unlike many previous attacks, this issue did not require plugins, authentication, or third-party code, making affected core installations particularly vulnerable. Security patches were released in WordPress 6.9.5 and 7.0.2.
wp2shell Vulnerability Exposed Core WordPress Sites
Tracked as CVE-2026-63030, the wp2shell vulnerability is described in the official WordPress release notes as a “REST API batch-route confusion and SQL injection” issue that can result in remote code execution. The flaw originates from the REST API batch endpoint located at /wp-json/batch/v1, or its legacy query-string alias ?rest_route=/batch/v1, allowing exploitation through a single anonymous web request.
The vulnerability was discovered by Adam Kues of Assetnote, an attack surface management division of Searchlight Cyber, through the WordPress HackerOne programme.
To provide defenders time to update their systems, Searchlight Cyber intentionally withheld technical exploitation details, stating, “Given the egregious nature of the flaw and to ensure defenders have adequate time, we are refraining from disclosing technical specifics at this juncture.”
Second SQL Injection Flaw Patched
The same security release also fixed CVE-2026-60137, another critical SQL injection vulnerability. WordPress credited researchers TF1T, dtro, and haongo for reporting the issue. Unlike the wp2shell vulnerability, this flaw predates the latest release and was backported to WordPress 6.8.6. The wp2shell vulnerability only affects versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1.
Severity ratings differ across security advisories. While WordPress classifies CVE-2026-63030 as “high severity,” the corresponding GitHub Security Advisory (GHSA-ff9f-jf42-662q) labels it as Critical with a CVSS score of 7.5. Regardless of classification, both vulnerabilities require immediate patching because the wp2shell vulnerability can be exploited without authentication.
Immediate Updates Recommended
Powering around 40% of websites, WordPress responded by enabling forced automatic updates for affected versions, including WordPress 7.1 beta2, to secure pre-release installations. As of 17 July, there were no confirmed reports of active exploitation. However, security researchers warned that because WordPress is open source and patch-related code changes became publicly available immediately, proof-of-concept exploits could emerge within hours.
Administrators should verify that every internet-facing WordPress installation has successfully received the update, as some hosting environments disable automatic updates or lock websites to specific versions. Site owners can also check exposure using the public tool available at wp2shell.com.
If immediate patching is not possible, temporarily blocking both REST API batch endpoints at the Web Application Firewall (WAF) level can reduce risk, although this should not replace installing the official update.
Security teams managing multiple WordPress websites should also monitor for spikes in anonymous web request traffic targeting batch endpoints, as the wp2shell vulnerability demonstrates how overlooked core features can introduce severe security risks.
