WordPress Core’s ‘wp2shell’ RCE Chain: One Week Later, Sites Are Still Catching Up

It’s been just over a week since WordPress’s security team shipped an emergency patch for what may be the most severe WordPress Core vulnerability disclosed in years — and administrators of the roughly 500 million websites estimated to run WordPress are still working through the fallout. The vulnerability, nicknamed “wp2shell,” combines two separate Core bugs into a pre-authentication remote code execution chain that requires no plugin, no account, and no user interaction whatsoever to exploit.

What wp2shell actually is

The wp2shell chain is made up of two distinct vulnerabilities that, individually, are serious but not catastrophic — and together, are about as bad as it gets for a content management system.

• CVE-2026-63030 is a route-confusion vulnerability in WordPress’s REST API batch endpoint (/wp-json/batch/v1), a feature introduced in WordPress 6.9 to let multiple API requests be bundled into a single call for performance reasons. The flaw allows the endpoint’s authorization checks to be bypassed entirely.
• CVE-2026-60137 is a SQL injection vulnerability in the author__not_in parameter of WP_Query, present in WordPress 6.8 and later. On its own, this flaw normally requires some level of authenticated access to reach.

Chained together, the route-confusion bug in CVE-2026-63030 strips away the authentication barrier that would normally limit CVE-2026-60137’s SQL injection to logged-in users, allowing a completely anonymous, unauthenticated attacker to reach the vulnerable query path on a stock WordPress installation — no third-party plugins required. From there, the SQL injection can be escalated into full remote code execution, handing an attacker the same level of control over the site and server that the web process itself has: altering pages, injecting redirects, exfiltrating configuration secrets like database credentials, planting a new administrator account, or leaving behind a persistent backdoor.

Discovery, disclosure, and a poorly timed patch window

The vulnerability was discovered by researcher Adam Kues of Searchlight Cyber’s Assetnote division and reported responsibly through WordPress’s HackerOne bug bounty program. WordPress’s security team published fixed releases — WordPress 7.0.2 and 6.9.5 — on July 17, 2026, alongside GitHub Security Advisories for both CVEs. WordPress 6.8.x installations, while not vulnerable to the full RCE chain, are still affected by the standalone SQL injection issue and received a corresponding fix in version 6.8.6.

Given the severity, WordPress’s security team took the relatively rare step of forcing automatic security updates onto every supported installation that has automatic updates enabled — a safety net built into WordPress Core specifically for emergencies like this one. But that safety net isn’t absolute: sites running older PHP versions, sites where automatic updates have been explicitly disabled by an administrator or hosting provider, and sites managed through certain custom deployment pipelines may not have received the forced update at all.

Complicating matters, several security researchers have criticized the timing of the disclosure itself: the patch went out on a Friday afternoon U.S. time — Friday evening across much of Europe — a window when security teams are traditionally slower to respond and attackers have historically been quicker to capitalize on the delay. Within hours of disclosure, public proof-of-concept exploit code began circulating, and multiple security firms have since confirmed active, in-the-wild exploitation attempts against unpatched sites.

Where things stand now

A week and a half after disclosure, the picture is a mix of good and concerning news. On the positive side, WordPress’s forced-update mechanism appears to have pushed the vast majority of actively maintained, mainstream-hosted sites onto patched versions relatively quickly. Searchlight Cyber has also released a free scanning tool at wp2shell.com that lets administrators check whether a given WordPress installation is still vulnerable, which has helped raise awareness beyond security-specialist circles.

On the more concerning side, the sheer scale of WordPress’s install base means even a small percentage of sites left unpatched still represents an enormous absolute number of vulnerable targets. Legacy sites, abandoned installations still technically online, sites behind hosting providers that don’t manage updates proactively, and any installation where an administrator disabled automatic updates for compatibility reasons remain squarely at risk. Given confirmed real-world exploitation, several security firms — including Rapid7 — have specifically recommended that administrators go beyond simply patching and actively check for signs of prior compromise, since a site could have been breached before the update was applied even if it’s fully patched now.

What administrators should do right now

• Confirm your version. Log into wp-admin, go to Dashboard > Updates, and verify you’re running WordPress 7.0.2, 6.9.5, 6.8.6, or a later release appropriate to your branch — don’t assume the forced update completed successfully.
• Check for signs of compromise, not just patch status. Review your list of installed plugins and themes for anything unfamiliar, audit admin user accounts for any that weren’t created by your team, and scan server logs for unusual requests to /wp-json/batch/v1 or ?rest_route=/batch/v1 in the period before you patched.
• Use temporary mitigations if you can’t patch immediately. If for any reason you cannot update right away, blocking the batch API endpoint at your web application firewall, or disabling anonymous REST API access through a security plugin, can reduce exposure until a proper update is possible — though this should be treated as a stopgap, not a substitute for patching.
• Re-enable automatic updates if you’ve disabled them. This incident is a strong argument for leaving WordPress’s automatic minor/security update mechanism switched on, reserving manual update control for major version changes where compatibility testing genuinely matters.
• Test with the community scanner. Tools like wp2shell.com offer a quick, low-effort way to confirm your site’s exposure status, particularly useful for administrators managing multiple installations across different hosts.

A broader lesson for the WordPress ecosystem

Beyond the immediate cleanup, wp2shell is a reminder of a structural reality that comes with running the web’s most popular CMS: WordPress Core’s enormous install base makes every Core-level vulnerability — not just plugin bugs, which are far more common — a potential internet-scale event. The REST API batch endpoint that enabled this particular chain was introduced for a perfectly reasonable performance optimization in WordPress 6.9, a useful illustration of how even well-intentioned new features can quietly introduce serious risk if authorization logic isn’t airtight from day one.

Why chained vulnerabilities are so hard to defend against

Individually, neither CVE-2026-63030 nor CVE-2026-60137 would likely have generated the level of alarm wp2shell has produced. A route-confusion bug that only bypasses authorization is a real problem, but a limited one on its own. A SQL injection flaw that normally requires an authenticated account is serious, but far less urgent than one reachable by anonymous visitors. It’s the combination — one bug removing the barrier that made the other bug’s impact limited — that turns two moderate-severity issues into a critical, pre-authentication remote code execution chain.

This is a pattern security researchers see again and again across major software ecosystems, not just WordPress: individual code reviews and automated scanners are generally good at catching a single vulnerability in isolation, but far less reliable at spotting the emergent risk created when two independently “acceptable” weaknesses interact. It’s part of why bug bounty programs like WordPress’s HackerOne initiative — which rewards researchers for finding exactly this kind of interaction, rather than just isolated bugs — have become such a valuable complement to internal security review processes.

What hosting providers are doing in response

In the days following disclosure, several major WordPress hosting providers moved to implement their own protective measures independent of WordPress Core’s forced-update mechanism, including web application firewall rules specifically targeting exploitation attempts against the batch API endpoint. Managed WordPress hosts — platforms that handle updates, security monitoring, and backups on behalf of site owners as part of their service — have generally been able to respond fastest, in some cases patching customer sites within hours of the disclosure. Site owners on self-managed hosting, shared hosting without proactive security monitoring, or older legacy infrastructure have generally taken longer to reach full protection, which lines up with where security researchers say the bulk of remaining vulnerable installations are concentrated.

A basic recovery checklist if you suspect compromise

For administrators who’ve confirmed their site was running a vulnerable version during the exposure window and want to check for signs of compromise before assuming everything is fine post-patch:

• Compare your list of active plugins and themes against what you remember installing — look specifically for anything with a generic or unfamiliar name.
• Review the WordPress admin user list for any accounts you don’t recognize, paying particular attention to accounts created around or after July 17.
• Check your site’s file system (via FTP, SFTP, or your host’s file manager) for unfamiliar PHP files, especially in upload directories where executable code shouldn’t normally exist.
• Search web server access logs for repeated or unusual requests to the batch API path in the days surrounding disclosure.
• If any of the above turns up something suspicious, consider restoring from a clean backup taken before July 17 rather than attempting to manually remove a potential backdoor, since incomplete cleanup is a common way sites get re-compromised.

Looking ahead

For site owners who came through this incident unaffected, the most useful long-term response isn’t just patching this specific vulnerability — it’s using the scare as a prompt to revisit update settings, confirm automatic updates are genuinely enabled, and build a habit of checking WordPress security advisories directly rather than relying solely on a hosting provider to catch everything. wp2shell won’t be the last Core-level vulnerability WordPress discloses, and the sites that weather the next one best will likely be the ones that treated this one as a wake-up call rather than a one-time emergency to forget about once the patch is applied.

For site owners, the actionable takeaway hasn’t changed much since this story broke: patch immediately if you haven’t, verify rather than assume, and treat WordPress Core updates with the same urgency you’d give an operating system security patch — because at the scale WordPress operates, that’s exactly what they are.