WordPress – Flaw Lets Unauthenticated Attackers Run Code

Overview

A newly disclosed WordPress core vulnerability, dubbed wp2shell, allows unauthenticated attackers to execute code on WordPress sites. The flaw affects bare installs with no plugins, making it especially dangerous. WordPress patched the issue on July 18, 2026, releasing versions 6.9.5 and 7.0.2 with forced auto‑updates to mitigate risk.

The Vulnerabilities

wp2shell is actually two chained bugs:

• CVE‑2026‑60137: SQL injection in WordPress core, exploitable via the author__not_in parameter in WP_Query.
• CVE‑2026‑63030: REST API batch‑route confusion, allowing attackers to bypass endpoint allow‑lists.

Chained together, they enable unauthenticated remote code execution (RCE).

Affected Versions

• 6.8.0 – 6.8.5 → SQL injection only, fixed in 6.8.6.
• 6.9.0 – 6.9.4 → Full RCE chain, fixed in 6.9.5.
• 7.0.0 – 7.0.1 → Full RCE chain, fixed in 7.0.2.
• 7.1 beta2 → Carries both fixes.

Sites running persistent object caches (Redis, Memcached) may avoid the RCE path, but the SQL injection remains exploitable.

Exploit Details

• Attackers exploit the batch endpoint (/wp-json/batch/v1) to confuse request arrays, bypassing authentication.
• Input lands in the vulnerable query, enabling SQL injection.
• Proof‑of‑concept exploit code is already public on GitHub.
• Cloudflare has shipped WAF rules to block the chain.

Severity & Industry Impact

• WordPress advisory rates the chain Critical.
• CVE scoring differs: RCE chain scored 7.5 (High), SQL injection scored 9.1 (Critical).
• With over 500 million WordPress sites globally, exposure is significant, though only sites running 6.9+ releases are vulnerable to full RCE.

Mitigation Steps

If you cannot update immediately:

• Block batch endpoints at WAF (/wp-json/batch/v1 and rest_route=/batch/v1).
• Disable WP REST API to prevent unauthenticated REST access.
• Use Searchlight’s drop‑in plugin to reject anonymous batch requests.

Ultimately, updating WordPress is the only reliable fix.

Expert in the Cloud Insight

wp2shell is a stark reminder that core vulnerabilities in WordPress can expose millions of sites overnight. Unlike plugin flaws, this exploit works on default installs, making it a high‑priority patch. The lesson for defenders: move fast when core updates ship, monitor batch endpoint traffic, and treat proof‑of‑concept releases as signals that exploitation is imminent.