A critical pre-authentication remote code execution (RCE) vulnerability in WordPress core, dubbed "wp2shell," has been actively exploited since mid-July 2026. Tracked as CVE-2026-63030 (the core RCE) and CVE-2026-60137 (the SQL injection enabler), this flaw allows unauthenticated attackers to execute arbitrary PHP code on any WordPress site running versions 6.0 through 6.8.1. With WordPress powering over 500 million websites, roughly 43% of the entire web, this is one of the most broadly impactful vulnerabilities in recent memory. The WordPress security team pushed an automatic background update to 6.8.2 within hours of public disclosure, but millions of sites with disabled auto-updates or custom update pipelines remain exposed. If you administer WordPress sites, you need to verify the patch status immediately.

Vulnerability Details

The wp2shell exploit chain combines two distinct vulnerabilities in the WordPress REST API:

CVE-2026-60137 (CVSS 9.1): A SQL injection vulnerability in the REST API batch endpoint (/wp-json/batch/v1). The endpoint fails to properly sanitize user-supplied input when processing batched requests, allowing an attacker to inject arbitrary SQL through carefully crafted nested request payloads. This vulnerability alone enables data exfiltration and, critically, the ability to write arbitrary PHP files to the database.

CVE-2026-63030 (CVSS 9.8): A pre-authentication RCE that chains the SQL injection with WordPress's plugin/theme file editor functionality. By leveraging the SQL injection to write a malicious PHP file to the wp-content directory via the wp_options table (specifically the active_plugins or stylesheet options), an attacker can then trigger code execution through the standard WordPress loading mechanism. No authentication, no user interaction, and no special configuration required. The vulnerability exists in a default WordPress installation.

Attack Vector: Network, unauthenticated, low complexity. The exploit requires only a single HTTP POST request to the REST API batch endpoint.

Affected Versions: WordPress 6.0 through 6.8.1 (all versions since the REST API batch endpoint was introduced). Version 6.8.2 and later are patched.

Exploit Maturity: Public proof-of-concept code is available. Active exploitation observed in the wild since July 17, 2026. A public scanner (wp2shell-scan) has been released by Searchlight Cyber, making detection trivial for attackers.

Impact Assessment

The blast radius is enormous:

• 500+ million websites potentially affected (all WordPress 6.0-6.8.1 installations)
• Complete server compromise on vulnerable hosts: attackers gain the privileges of the web server user (typically www-data, apache, or nginx)
• Data theft: Full database access via SQL injection, including user credentials, PII, and application secrets
• Persistence: Attackers can plant backdoors, modify core files, inject malicious JavaScript for supply-chain attacks on visitors
• Lateral movement: Compromised web servers often serve as beachheads for internal network pivoting

High-value targets include enterprise WordPress multisite networks, managed hosting providers, e-commerce sites running WooCommerce, and government/educational institutions using WordPress for public-facing portals.

Affected Systems

You need to act if you operate:

• Self-hosted WordPress (any hosting: VPS, dedicated, shared, containerized)
• WordPress multisite networks (single compromise = all sites in network)
• Managed WordPress hosting (verify your provider has applied the auto-update; some delay updates for compatibility testing)
• Docker/Kubernetes deployments using official WordPress images older than 6.8.2
• Local development environments (often overlooked, but can be pivot points)

Not affected: WordPress.com hosted sites (Automatic patches centrally), sites already on 6.8.2+, and sites running 5.9 or earlier (the batch endpoint didn't exist).

Mitigation & Patching

Immediate Action (Do This Now)

1. Verify your version: Log into wp-admin, Dashboard, Updates, or run wp core version via WP-CLI.
2. Update to 6.8.2 immediately:
   • Dashboard, Updates, "Update Now"
   • WP-CLI: wp core update --version=6.8.2
   • If auto-updates are enabled, the patch may already be applied. Verify anyway.
3. Clear all caches: Server-level (Varnish, Nginx, Cloudflare), plugin-level (WP Rocket, W3 Total Cache), and browser cache.

If You Cannot Update Immediately

1. Block the REST API batch endpoint at the web server level:

   nginx
   apache

2. Disable the REST API entirely if not needed (breaks block editor, some plugins):

   php

3. Deploy a WAF rule targeting the batch endpoint with SQLi payloads (ModSecurity, Cloudflare, AWS WAF all have updated rulesets).

Post-Patch Verification

1. Scan for compromise: Run the public wp2shell scanner against your own sites:

   bash

2. Check for malicious files: Look for recently modified PHP files in wp-content/uploads/, wp-content/plugins/, and wp-content/themes/:

   bash

3. Audit database: Check wp_options for suspicious active_plugins, stylesheet, or template values:

   sql

4. Rotate all credentials: Database passwords, WordPress salts (wp-config.php), API keys, SFTP/SSH credentials.

Detection

Indicators of Compromise

Network IOCs:

• POST requests to /wp-json/batch/v1 with nested requests arrays containing SQL syntax (UNION, SELECT, INTO OUTFILE, 0x hex encoding)
• User-Agent strings: wp2shell, Searchlight Cyber Scanner, or generic python-requests

Host IOCs:

• New PHP files in wp-content/uploads/ with recent timestamps
• Modified index.php or wp-config.php with injected eval(), base64_decode(), or @include statements
• Suspicious cron jobs in wp_options (cron option) or system crontab
• New admin users with random usernames (check wp_users table)

Log Sources:

• Web server access logs (Nginx/Apache)
• WordPress debug log (wp-content/debug.log if enabled)
• WAF/firewall alerts
• File integrity monitoring (Tripwire, AIDE, OSSEC)

Detection Rules

Suricata:

YARA:

Sigma (Splunk/Elastic):

Frequently Asked Questions

Q: Does this affect WordPress.com sites? A: No. WordPress.com is managed by Automattic and was patched centrally before public disclosure. Only self-hosted installations are at risk.

Q: My site is on WordPress 5.9. Am I safe? A: Yes. The vulnerable batch endpoint (/wp-json/batch/v1) was introduced in WordPress 6.0. Versions 5.9 and earlier do not have this attack surface.

Q: I have auto-updates enabled. Do I still need to check? A: Yes. Auto-updates can fail due to filesystem permissions, PHP version incompatibilities, or hosting provider delays. Always verify the version number in wp-admin.

Q: Can I just disable the REST API instead of updating? A: Disabling the REST API breaks the block editor (Gutenberg), many plugins, and mobile apps. It's a valid temporary mitigation but not a long-term solution. Update to 6.8.2.

Q: Are there any signs my site was already compromised before I patched? A: Check for the IOCs listed in the Detection section. The most reliable indicator is unexpected PHP files in wp-content/uploads/ or modified core files. Run the wp2shell scanner for automated detection.

Q: Does this affect WooCommerce or other plugins? A: The vulnerability is in WordPress core. Any plugin or theme running on an unpatched WordPress version is exposed. Update core first, then update all plugins/themes.

Q: What if I'm on a managed host that hasn't pushed the update yet? A: Contact support immediately and request an expedited update. In the meantime, implement the Nginx/Apache block rule for the batch endpoint as a stopgap.

Key Takeaways

• wp2shell (CVE-2026-63030 + CVE-2026-60137) is a critical, wormable pre-auth RCE in WordPress core affecting versions 6.0 to 6.8.1
• 500+ million sites are potentially vulnerable. This is the largest WordPress attack surface in years
• Active exploitation is ongoing; public exploit code and scanners are available
• Patch to 6.8.2 immediately. Auto-updates may not have completed on all hosts
• If you cannot patch now, block /wp-json/batch/v1 at the web server layer as an emergency mitigation
• Post-patch, scan for compromise using the public wp2shell scanner and check for webshells in wp-content/uploads/
• Rotate all credentials after patching; assume database credentials were exposed if the site was vulnerable

Conclusion

The wp2shell vulnerability represents a watershed moment for WordPress security: a pre-authentication RCE in a core API endpoint that ships enabled by default, affecting every major version released in the last three years. The WordPress security team's rapid response (coordinated disclosure, automatic background updates, and clear communication) is commendable, but the sheer scale of the install base means millions of sites will remain unpatched for weeks or months. If you operate WordPress infrastructure, treat this as a Code Red event: verify your version, apply the update, and hunt for signs of compromise today. The cost of inaction is total server compromise.

---

Sources:

• Searchlight Cyber: "wp2shell: Pre-Auth RCE in WordPress Core via REST API Batch Endpoint" (July 18, 2026)
• CyberPress: "Critical WordPress wp2shell Flaw Lets Anonymous Attackers Execute Remote Code" (July 18, 2026)
• Help Net Security: "Two new high severity WordPress vulnerabilities, patch immediately!" (July 18, 2026)
• WordPress.org Security Release: "WordPress 6.8.2 Security Release" (July 18, 2026)
• wp2shell Scanner: https://github.com/searchlightcyber/wp2shell-scan