What Is WP2Shell? WordPress RCE Vulnerability Explained

Key takeaways

• wp2shell is the public nickname for a chain of two WordPress core flaws (CVE-2026-63030 and CVE-2026-60137) that can lead to unauthenticated remote code execution on default installs.
• Full remote-code-execution impact affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1.
• Fixed versions are 6.9.5 and 7.0.2 (and later). WordPress 6.8.x has a related SQL injection issue fixed in 6.8.6.
• Exploitation has been observed in the wild. Updating is the primary defense.
• No plugins or themes are required for the full chain on vulnerable core versions.

wp2shell is the informal name security researchers gave to a serious pair of bugs in WordPress core. The name is a simple play on words: “wp” for WordPress and “to shell,” meaning an attacker can move from an ordinary web request to running their own commands on the server.

It is not a single isolated bug. It is a chain. One flaw in how the REST API handles certain batch requests can be combined with a SQL injection issue in WordPress’s query handling. Together they allow an unauthenticated attacker to reach remote code execution on a stock WordPress site that has not been updated.

This matters because WordPress powers a huge portion of the web. Many sites run default or near-default configurations. The entry point involved is enabled by default on modern versions, and no extra plugins or special settings are needed for the full impact on the listed versions.

Affected WordPress Versions

Version Range	Impact	Fixed In
7.0.0 – 7.0.1	Full unauthenticated RCE chain	7.0.2
6.9.0 – 6.9.4	Full unauthenticated RCE chain	6.9.5
6.8.0 – 6.8.5	SQL injection only	6.8.6
6.7 and earlier	Not affected by this chain	—

WordPress released the security updates on 17 July 2026 and pushed automatic updates for the affected branches. Sites that receive automatic security updates should already be on a patched version if the update process worked normally. Manual verification is still recommended.

Why wp2shell Is Different from Most WordPress Issues

Most serious WordPress problems live in plugins or themes. wp2shell sits in core itself. That means a plain installation with no extra plugins can still be exposed if it runs one of the vulnerable version ranges.

The attack requires no login, no social engineering, and no user interaction on the site owner’s side. Security researchers and multiple firms confirmed that attackers began scanning and attempting exploitation shortly after public disclosure. Reports noted significant volumes of probing traffic and some confirmed deployments of webshells.

Because the issue is in core and the surface is widely reachable, the practical advice is straightforward: treat any site still on 6.9.0–6.9.4 or 7.0.0–7.0.1 as urgent.

How the Vulnerability Chain Works

Two separate problems work together:

1. A route-confusion issue in the REST API batch endpoint (CVE-2026-63030). Under certain crafted conditions the internal handling of nested or malformed batch requests can become desynchronized. This can allow a request to reach code paths it should not reach without proper checks.
2. A SQL injection issue involving the author__not_in parameter in WP_Query (CVE-2026-60137). When the first issue allows an attacker-controlled value to reach this parameter without normal sanitization, database queries can be influenced.

On its own, each piece has limits. Combined, and with further steps that leverage legitimate WordPress features (such as caching and privilege mechanisms), the result on vulnerable versions is unauthenticated remote code execution. Exact technical reproduction details are omitted here; the public record and official advisories contain the formal descriptions for security researchers and defenders.

Real-World Impact and Observed Activity

Multiple independent sources (including cloud security firms and incident-response teams) reported active scanning and exploitation attempts within days of the July 2026 disclosure. Attackers have been observed deploying webshells after successful compromise. Some organizations found that a substantial percentage of their WordPress instances were initially vulnerable, with a smaller but still significant portion internet-exposed.

Consequences of successful exploitation can include:

• Full site takeover
• Theft of user data and credentials
• Installation of persistent backdoors
• Use of the server for further attacks
• Defacement or ransomware-style activity

Because the chain does not require authentication, automated tools can target large numbers of sites quickly.

How to Check If Your Site Is Affected

1. Log into your WordPress dashboard and look at the version number (or check via the site’s publicly visible generator meta tag or REST API if available).
2. Confirm you are running at least 6.9.5, 7.0.2, or a later release. For the 6.8 branch, confirm 6.8.6 or newer.
3. If you use managed hosting, check the host’s control panel or support announcements for confirmation that the security update was applied.
4. Consider a reputable vulnerability scanner or the official checker resources published by the researchers (where available) for additional validation. Prefer non-destructive checks only.

Do not rely solely on the version number if the site has custom modifications or object caching that might affect exploitability; the safest assumption for unpatched versions in the full-RCE range is that they are at risk.

How to Protect and Remediate

Immediate steps

• Update WordPress core to 6.9.5, 7.0.2, or the latest available release as soon as possible. Use the official dashboard update mechanism or your host’s one-click tools.
• Verify the update succeeded by checking the version number again after the process completes.
• If automatic updates are enabled, confirm they are functioning and that security releases are allowed.

Additional hardening while or after updating

• Keep a current, tested backup.
• Review and rotate administrator passwords and invalidate existing sessions.
• Limit or carefully monitor access to the REST API if your site does not require public batch functionality.
• Ensure a web application firewall (WAF) is active and has rules covering the known patterns where available.
• Audit installed plugins and themes; remove anything unused or unmaintained.
• Monitor access and error logs for unusual activity around the batch endpoint or unexpected file changes in wp-content.

If you suspect compromise

Treat the site as potentially breached. Update to a patched version first, then perform a full cleanup: remove unknown files (especially in uploads, cache, and plugin directories), reset all credentials, review database for unexpected users or options, and restore from a known-good backup if necessary. Professional incident-response help is advisable for important sites.

Frequently Asked Questions

What does wp2shell mean? It is a nickname meaning “WordPress to shell.” It describes going from an unauthenticated request to the ability to run code on the server.

Do I need a vulnerable plugin for this to work? No. On the versions that support the full chain, a default WordPress installation is sufficient.

Is my site safe if I am on an older version than 6.8? Versions before the affected ranges are not impacted by this particular chain. You should still keep WordPress and all components updated for other reasons.

Was this discovered by AI? Public reporting indicates AI tools assisted in aspects of the research and proof-of-concept work. The formal credit goes to the human researchers who reported the issues.

Is there a temporary mitigation if I cannot update right away? Updating is strongly preferred. Temporary measures such as WAF rules that block the relevant batch patterns or a small custom restriction on the batch endpoint have been discussed by researchers, but they are not substitutes for the official patches.

How urgent is this? Very. Exploitation activity was observed quickly after disclosure. Unpatched sites in the full RCE version ranges should be treated as high priority.

Final Advice

wp2shell is a reminder that even mature, widely used software can contain serious issues in core components. The practical response for site owners is simple and effective: keep WordPress updated, verify the version after security releases, maintain good backups, and monitor for unusual activity.

If you run WordPress, check your version today. Apply the security updates if you have not already done so. Staying current remains the single most reliable defense against this and future core issues.

For more practical WordPress security guidance and site-management tips, visit the homepage of Nomatali.