Wp2shell: The Unauthenticated WordPress Exploit That Needs No Login, No Plugins, Just a Vulnerable Core
Published
Key Takeaways
- Vulnerability disclosed: WordPress patched wp2shell (CVE-2026-63030), a critical pre-authentication RCE in core, on July 17, 2026.
- Exploit chain: The flaw pairs a REST API batch-route confusion with a WP_Query SQL injection (CVE-2026-60137).
- Patch status: Fixes ship in versions 6.9.5 and 7.0.2, with forced automatic updates enabled.
WordPress patched wp2shell (CVE-2026-63030), a critical pre-authentication remote code execution vulnerability in WordPress core, by releasing versions 6.9.5 and 7.0.2 on July 17, 2026. The flaw allows an anonymous attacker to run code on a default installation, as no plugins, no login, and no user interaction are required.
Yet, administrators should not assume the patch landed automatically – forced pushes can fail on sites with auto-updates disabled, so confirming the update actually applied is essential.
Wp2shell Chains Two Core Vulnerabilities
Wp2shell is a chain of two distinct vulnerabilities working together, as SOC Radar also detailed in FAQs for CISOs:
- CVE-2026-63030 – a REST API batch-route confusion in the serve_batch_request handler, introduced in WordPress 6.9, rated Critical in the GitHub advisory.
- CVE-2026-60137 – an SQL injection in the author__not_in parameter of the internal WP_Query class, present since WordPress 6.8.
An anonymous attacker reaches the batch endpoint, exploits the route confusion to slip a rogue parameter into WP_Query, and drives the SQL injection through to code execution, turning the two flaws into a full pre-auth compromise.
Affected WordPress Versions
The complete RCE chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. WordPress fixed the issue in 6.9.5 and 7.0.2 and enabled forced automatic updates for affected sites.
Researchers and admins are treating wp2shell as a higher-priority patch due to the cross-component chaining.
Discovery, Disclosure, and Exploitation Status
Adam Kues of Assetnote, the attack surface management arm of Searchlight Cyber, discovered wp2shell and responsibly disclosed it through WordPress's HackerOne program. As of July 18, 2026, no confirmed in-the-wild exploitation has been reported.
A public proof-of-concept (PoC) demonstrating the SQL injection component has already appeared, capable of reading the database, including administrator password hashes. Cloudflare reported that the vulnerable code path can be reached when a persistent object cache is not in use, which is a common default.
In April, a WordPress Essential Plugin backdoor was disseminated to 20,000+ active WordPress installations.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular