Publicly available exploits have emerged for a pair of critical remote code execution (RCE) vulnerabilities in WordPress Core, collectively dubbed "wp2shell." These flaws, identified as CVE-2026-63030 and CVE-2026-60137, can be chained together to allow pre-authentication RCE on affected WordPress installations. Administrators are strongly advised to update their sites immediately.
The vulnerabilities were discovered by Adam Kues of Searchlight Cyber, whose research team confirmed that an unauthenticated attacker can exploit them against a default WordPress installation without any preconditions or plugins. Searchlight Cyber estimates that over 500 million websites utilize WordPress, indicating a potentially vast impact, particularly now that proof-of-concept (PoC) exploits are publicly available.
WordPress has responded by enabling forced automatic security updates for supported installations running the affected versions, urging site owners to update to WordPress 7.0.2 or 6.9.5 without delay. The company emphasized the severity of the issue in its security announcement, recommending immediate updates.
The "wp2shell" attack chain comprises two distinct vulnerabilities. The first, CVE-2026-63030, is a REST API batch-route confusion flaw introduced in WordPress 6.9. This vulnerability can be combined with the second flaw to achieve RCE. The second vulnerability, CVE-2026-60137, is a high-severity SQL injection flaw found in the 'author__not_in' parameter of 'WP_Query', affecting WordPress 6.8 and later.
According to WordPress advisories, the complete RCE chain impacts WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. While the SQL injection vulnerability (CVE-2026-60137) also affects WordPress 6.8.0 through 6.8.5, it cannot be chained to RCE in these versions because the REST API batch-route confusion bug (CVE-2026-63030) was introduced later, in WordPress 6.9. The full wp2shell attack chain has been addressed in WordPress 6.9.5 and 7.0.2.
Searchlight Cyber initially withheld technical details to allow administrators time to patch, instead launching the wp2shell.com website for site owners to check their installations for vulnerability. For organizations unable to update immediately, Searchlight Cyber suggests temporary mitigations such as installing a plugin to block anonymous access to the REST API entirely, or blocking '/wp-json/batch/v1' and '?rest_route=/batch/v1' at a Web Application Firewall (WAF) level. These are considered temporary measures until systems can be fully updated.
Cloudflare has also implemented WAF protections for both vulnerabilities across all its plans, including free accounts, for sites proxied through its platform. These rules are designed to block exploitation attempts for both the SQL injection flaw and the REST API batch-route confusion vulnerability. Cloudflare noted that WAF protections reduce exposure but are not a substitute for applying the official patches.
Despite Searchlight Cyber's delay in releasing technical specifics, multiple public proof-of-concept exploits have since appeared on GitHub. Some of these exploits combine the vulnerabilities to extract WordPress password hashes via SQL injection, then crack an administrator password to gain access, upload a malicious plugin, and execute commands. Other PoC exploits claim to achieve pre-authentication RCE without requiring administrator credentials, aligning with Searchlight Cyber's initial description of the flaws.
Security firm watchTowr has reported observing in-the-wild exploitation following the release of these public exploits. The company noted that highly impactful, unauthenticated SQL injection or RCE vulnerabilities in WordPress core are rare, making this particular vulnerability significant and prompting a rapid response from the security community to patch before widespread exploitation occurs.
Given the availability of public PoC exploits and confirmed reports of in-the-wild exploitation, administrators must prioritize updating their WordPress sites to versions 7.0.2 or 6.9.5 as quickly as possible.
