WordPress Core Vulnerability ‘wp2shell’ Allows Anonymous Code Execution via Chained Exploits

July 18, 2026 – A critical security vulnerability within the core of WordPress, dubbed "wp2shell," has been fully detailed, revealing a two-part exploit chain that allows anonymous attackers to execute arbitrary code on vulnerable websites. Initially flagged by researchers, the vulnerabilities have now been assigned CVE identifiers, the complete exploitation mechanism has been published, and a working proof-of-concept is publicly available, escalating the urgency for website administrators to update their systems.

The exploit leverages two distinct flaws: CVE-2026-63030, a confusion in the REST API’s batch routing, and CVE-2026-60137, a SQL injection vulnerability within WordPress core itself. When chained together, these vulnerabilities enable an attacker to bypass authentication entirely and achieve code execution on a target WordPress site. This means even a bare installation of WordPress, without any third-party plugins, can be compromised. All sites running versions 6.9 and 7.0 were susceptible until WordPress released critical patches in versions 6.9.5 and 7.0.2, which were deployed via its auto-update system, including a forced update mechanism.

The timeline of this disclosure highlights a race between patching and exploitation. Adam Kues from Assetnote, the attack surface management division of Searchlight Cyber, discovered the batch-route confusion and reported it through WordPress’s official HackerOne program. His findings, published under the moniker "wp2shell," underscored the severity of the attack, stating it possesses "no preconditions and can be exploited by an anonymous user." The SQL injection component was reported independently by a trio of researchers: TF1T, dtro, and haongo.

The Anatomy of the wp2shell Exploit

The wp2shell exploit is a sophisticated chaining of two separate vulnerabilities, each with its own scope and impact.

CVE-2026-63030: REST API Batch-Route Confusion

This vulnerability, discovered by Adam Kues of Assetnote, resides in the WordPress REST API’s batch endpoint. Introduced in WordPress version 5.6 in November 2020, the batch endpoint allows for multiple sub-requests to be processed within a single HTTP request. The flaw lies in how WordPress manages these sub-requests, particularly when errors occur. When an error in one sub-request disrupts the internal tracking arrays used to manage parallel requests, it can cause a one-step desynchronization. This desynchronization can lead to a subsequent request being processed by an unintended handler, effectively bypassing security checks and access controls. The vulnerability specific to this route confusion was introduced with the release of WordPress 6.9.

CVE-2026-60137: SQL Injection in WordPress Core

This SQL injection vulnerability is a more foundational flaw, impacting a broader range of WordPress versions. It was identified as residing within the WP_Query class, specifically in how it handles the author__not_in parameter. Normally, this parameter expects an array of author IDs to exclude from query results. However, if an attacker provides a string value instead of an array, the validation check is skipped. This allows the raw, attacker-controlled string to be directly injected into the SQL query, enabling attackers to manipulate database queries, potentially extracting sensitive information or even altering data. This SQL injection vulnerability dates back to WordPress version 6.8.

The Chained Exploitation

The power of wp2shell comes from combining these two vulnerabilities. An unauthenticated attacker first exploits the REST API batch-route confusion (CVE-2026-63030) to bypass authentication and gain access to internal WordPress functions. This access allows them to target the WP_Query class and specifically manipulate the author__not_in parameter. By providing a malformed string, they trigger the SQL injection (CVE-2026-60137), allowing them to execute arbitrary SQL commands. In a full remote code execution (RCE) scenario, this SQL injection can be leveraged to write malicious files to the server or manipulate existing files, ultimately leading to arbitrary code execution.

Scope of Vulnerability and Patching Efforts

The effective range of the wp2shell exploit is critical for understanding the threat landscape. The SQL injection vulnerability (CVE-2026-60137) has a deeper historical reach, affecting WordPress versions from 6.8 onwards. However, the critical RCE chain, which requires the REST API batch-route confusion, is present only in WordPress versions 6.9 and later. This means that sites running version 6.8 are vulnerable to the SQL injection but not the full RCE chain via this specific mechanism.

WordPress released patches to address these vulnerabilities:

• WordPress 6.9.5 (released Friday, July 17, 2026) addresses both vulnerabilities for sites running the 6.9 branch.
• WordPress 7.0.2 (released Friday, July 17, 2026) addresses both vulnerabilities for sites running the 7.0 branch.
• WordPress 6.8.6 (released Friday, July 17, 2026) addresses the SQL injection vulnerability (CVE-2026-60137) for sites still running the older 6.8 branch, though it does not contain the batch-route confusion flaw.
• WordPress 7.1 beta2 has also been updated to include both fixes.

WordPress implemented what it refers to as "forced updates" through its auto-update system for these critical patches. This measure was taken to ensure the widest possible coverage given the severity of the threat. However, it remains unclear whether these forced updates reached sites where users had explicitly disabled the auto-update functionality. Administrators are strongly advised to verify their current WordPress version directly rather than relying solely on the assumption that the update has been applied.

Background and Discovery

The discovery of wp2shell highlights the ongoing cat-and-mouse game between security researchers and software vendors. Searchlight Cyber’s detailed write-up, released on July 17, 2026, provides a comprehensive technical analysis. While Searchlight is withholding its own in-depth technical report for a limited period, a dedicated checker website, wp2shell.com, has been made available for site owners to assess their vulnerability status.

The rapid dissemination of exploit details is a common trend in the cybersecurity world. Despite Searchlight’s initial reticence, the release of the patch itself, with its changed files clearly documented, provided enough information for other researchers to reverse-engineer the mechanism. Within a short period, the full exploit chain was published, and a functional proof-of-concept appeared on GitHub, accelerating the potential for widespread exploitation.

Broader Implications and Analysis

With an estimated 500 million websites running on WordPress globally, the potential impact of this vulnerability is significant. However, the RCE chain is specifically tied to versions 6.9 and above, which were released after December 2, 2025. This narrows the directly exposed population to sites running relatively recent versions of WordPress, though the exact number remains unspecified.

The scoring of these vulnerabilities presents an interesting dichotomy. WordPress’s own advisory rates the full RCE chain as "Critical." However, its official CVE record scores it at 7.5 (High), with impact metrics focusing solely on data access, not the integrity or availability losses typically associated with code execution. The SQL injection component, on its own, receives a score higher than 9.1 (Critical). This discrepancy suggests that the scoring system may not fully capture the cascading effects of the chained exploit. Security professionals are advised to track both CVEs independently rather than relying on a single label.

A Persistent Object Cache Condition

A notable condition that can mitigate the risk of the full RCE path is the presence of a persistent object cache. According to Cloudflare, which also released Web Application Firewall (WAF) rules alongside the disclosure, the code execution path is only viable when a site is not running a persistent object cache. This means that default WordPress installations, which typically do not employ such caching mechanisms, remain fully exposed to the RCE attack. Sites utilizing Redis or Memcached as persistent object caches might be protected from this specific RCE vector, but this does not offer protection against the underlying SQL injection vulnerability.

Official Responses and Industry Reactions

As of July 18, 2026, the wp2shell vulnerabilities were not yet listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, which requires confirmed instances of exploitation. No public reports of active exploitation had emerged by this date. However, this lack of immediate exploitation does not diminish the threat, especially given the public availability of the exploit.

Security scanner providers are moving quickly to incorporate detection. Rapid7 announced that authenticated checks for InsightVM and Nexpose would be available by July 20, 2026. The cybersecurity industry has seen a surge in mass exploitation campaigns, often targeting WordPress. For instance, a previous vulnerability in a caching plugin, exploited before its server was compromised in June 2026, allowed the "WP-SHELLSTORM" group to compromise over 17,000 sites. The wp2shell vulnerability, being present in core and exploitable on default settings, presents a potentially broader and more immediate threat.

Mitigations for Unpatched Systems

For website administrators unable to update their WordPress installation immediately, Searchlight Cyber has outlined several temporary mitigation strategies. These primarily focus on preventing anonymous access to the batch endpoint.

• Web Application Firewall (WAF) Rules: Implementing WAF rules to block requests to /wp-json/batch/v1 from unauthenticated users. This is a crucial step, as it directly targets the entry point for the RCE chain.
• Disabling the Batch Endpoint: If not essential for legitimate site functionality, disabling the batch endpoint entirely through configuration or custom code could prevent exploitation. However, this carries the risk of breaking legitimate integrations that rely on this feature.
• Rate Limiting: Implementing aggressive rate limiting on the batch endpoint can make it more difficult for attackers to scan and exploit vulnerable sites effectively, although it does not prevent exploitation altogether.

These are considered stopgap measures, and updating WordPress to the latest patched version remains the only definitive solution. The open-source nature of WordPress means that once a patch is released, the information required to understand and exploit the vulnerability is readily available. The race to patch is therefore paramount.

The Race Against Time

The disclosure of wp2shell underscores a critical dynamic in cybersecurity: the race between vulnerability patching and exploit development. WordPress’s decision to implement forced updates signals the extreme concern surrounding these flaws. However, the speed at which the exploit mechanism was published and a proof-of-concept developed demonstrates the agility of the threat actor community.

The ultimate impact of wp2shell will be determined by two key metrics: the speed at which WordPress sites adopt the patches and the rate at which attackers begin actively scanning for and exploiting vulnerable systems. The widespread adoption of WordPress, coupled with the critical nature of remote code execution vulnerabilities, places immense pressure on site owners to act swiftly. The coming days and weeks will reveal the true extent of this threat and how effectively the WordPress ecosystem responds to this significant security challenge.