WordPress Core "wp2shell" RCE flaws get public exploits, patch now

# Critical WordPress RCE Chain "wp2shell" Now Has Public Exploits—Update Immediately

## The Threat

A critical remote code execution vulnerability chain in WordPress Core has escaped into the wild with public proof-of-concept exploits now circulating on GitHub, forcing administrators to treat this as an active, weaponized threat. The attack, branded "wp2shell" by security researchers, combines two distinct flaws into a devastating pre-authentication exploit that bypasses WordPress's standard authentication mechanisms entirely.

The vulnerability chain consists of CVE-2026-63030, a REST API batch-route confusion bug introduced in WordPress 6.9, and CVE-2026-60137, an SQL injection flaw in the author__not_in parameter of WP_Query. An unauthenticated attacker can chain these flaws together to achieve arbitrary remote code execution on any default WordPress installation running affected versions—no plugins required, no special configuration needed. Searchlight Cyber, the security firm that discovered the vulnerabilities, confirmed that the attack works against stock WordPress installs with zero preconditions.

The scale of exposure is staggering. WordPress powers over 500 million websites globally, representing roughly 43% of all websites with known CMS technology. Even if only a fraction of those sites remain unpatched, the potential victim count represents one of the largest software supply chain attack surfaces in existence. The fact that public exploits are now available transforms this from a "patch when you can" scenario into an urgent incident response situation.

## Severity and Impact

| Aspect | Details |

|--------|---------|

| Primary CVE | CVE-2026-63030 (REST API batch-route confusion) & CVE-2026-60137 (SQL injection) |

| Attack Vector | Network-based, pre-authentication, no user interaction required |

| Attack Complexity | Low—exploitable through standard HTTP requests |

| Authentication Required | None—unauthenticated remote exploitation |

| Severity Rating | Critical (RCE chain) / High (SQL injection component) |

| Impact | Complete system compromise, arbitrary code execution, data theft, website defacement |

| Scope | WordPress Core—affects base installation regardless of plugins or themes |

| Status | Public exploits released; automatic forced updates enabled by WordPress.org |

## Affected Products

Directly Vulnerable (Full RCE Chain):

SQL Injection Component (CVE-2026-60137 only):

Fixed Versions:

## Mitigations

Immediate Actions (Do This Now):

1. Update WordPress Core immediately. WordPress.org has enabled forced automatic security updates for installations running 6.9.x and 7.0.x versions. If your site is configured to allow automatic updates, patches should deploy automatically. Verify completion by checking your WordPress dashboard.

2. Manual patching for sites with updates disabled. If you have disabled automatic updates, manually update to WordPress 6.9.5 (if running 6.9.x) or 7.0.2 (if running 7.0.x) through the WordPress admin dashboard or via SSH using wp cli core update.

3. Test your installation. Searchlight Cyber has published a testing utility at wp2shell.com that allows administrators to verify whether their WordPress installation remains vulnerable. Use this to confirm patching was successful.

Temporary Workarounds (If Immediate Patching Is Impossible):

These workarounds are not a substitute for patching and should only be used as emergency measures while you prepare updates:

Important: These mitigations only reduce exposure—they do not eliminate the risk. Treat them as temporary stopgaps, not permanent solutions.

## References

---

## HackWire Analysis

The release of public exploits for wp2shell represents a critical inflection point where a high-impact vulnerability transitions from theoretical risk to active threat landscape reality. The WordPress ecosystem's scale—half a billion sites—means that even typical patch adoption curves (which historically run 20-30% within the first month for non-critical updates) will leave hundreds of millions of vulnerable installations exposed.

What makes wp2shell particularly dangerous is not the complexity of the flaw, but its accessibility. Unlike many sophisticated chain exploits that require specific environmental conditions or custom payloads, wp2shell works against default WordPress installations. A script-kiddie-level attacker with a basic HTTP tool can begin mass exploitation immediately. Threat actors are likely already scanning for vulnerable instances and pre-positioning backdoors.

The timing amplifies the risk. Summer is historically peak vacation season for IT teams, meaning patch response times will be slower than during normal operating periods. Organizations running production WordPress sites during July-August commonly experience deployment delays due to skeleton crews and change-control freezes. This creates a perfect storm: weaponized exploit + massive vulnerable population + seasonal staffing gaps.

The WordPress.org decision to force automatic updates is defensible from a security standpoint but highlights a deeper ecosystem problem: WordPress's fragmented installation base, plugin compatibility constraints, and frequent custom modifications mean that many site operators cannot safely accept automatic updates without risking compatibility breaks. Some installations will deliberately defer patching to avoid triggering unknown issues—and will now face targeted exploitation.

Defenders should treat this as an active incident scenario, not a routine patch cycle. Scan your networks for WordPress installations immediately. Prioritize sites handling sensitive data, payment processing, or customer authentication. If you cannot patch within 48 hours, deploy the temporary mitigations (REST API blocking via plugin + WAF rules). Monitor web server logs for suspicious /wp-json/batch/v1 requests. Start blocking exploits today while you stage patches for tomorrow.

— HackWire Editorial

## Related Coverage