Public exploits are now available for a pair of critical vulnerabilities in WordPress Core, which, when chained, allow attackers to achieve pre-authentication remote code execution on affected installations. The flaws, collectively dubbed "wp2shell," impact WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
The vulnerabilities are tracked as CVE-2026-63030 and CVE-2026-60137. CVE-2026-63030 is a REST API batch-route confusion bug that was introduced in WordPress 6.9. CVE-2026-60137 is a high-severity SQL injection flaw found in the `author__not_in` parameter of `WP_Query`.
Cybersecurity researchers at Searchlight Cyber discovered these flaws, noting that they can be exploited by an anonymous user on a default WordPress installation without any plugins. This makes immediate patching crucial for the estimated 500 million websites that utilize WordPress.
WordPress has confirmed the issues and released security updates. The company's 7.0.2 security release addresses one critical and one high-severity security issue. Due to the severity of these vulnerabilities, the WordPress.org team has enabled forced updates via its auto-update system for sites running the affected versions.
Site owners are strongly advised to update immediately to WordPress 7.0.2 or 6.9.5, as these versions prevent the exploitation of the wp2shell attack chain.
For administrators unable to patch immediately, temporary mitigation strategies include blocking anonymous access to the REST API batch endpoint. This can be achieved through a security plugin or by implementing Web Application Firewall (WAF) rules targeting `/wp-json/batch/v1` and `?rest_route=/batch/v1`. However, Searchlight Cyber emphasizes that these are only temporary measures and may impact legitimate site functions, making a full update the preferred and most secure solution.
Researchers initially withheld technical details of the exploits to provide organizations with time to patch. They have since released an online tool to assist administrators in checking whether their WordPress instances are vulnerable.
