A critical vulnerability chain dubbed wp2shell was disclosed on July 17, 2026, affecting millions of WordPress sites running versions 6.9 through 7.0.1. The flaw allows unauthenticated attackers to execute arbitrary code on a default WordPress installation with zero plugins required. WordPress released emergency patches 6.9.5 and 7.0.2 on July 18, and the full exploit chain is now public.

Background

WordPress powers over 43 percent of all websites, roughly 500 million installations. On July 17, Searchlight Cyber's research team disclosed wp2shell, a pre-authentication remote code execution (RCE) chain in WordPress core. The vulnerability earned two CVE identifiers: CVE-2026-63030 (REST API batch route confusion) and CVE-2026-60137 (SQL injection in WP_Query). Together, they form a complete unauthenticated RCE path from a single HTTP request.

The vulnerability was discovered by Adam Kues of Searchlight Cyber (Assetnote) and reported through WordPress's HackerOne program. Separate researchers TF1T, dtro, and haongo reported the SQL injection component.

Why This Matters

This is not a plugin or theme vulnerability. It lives in WordPress core, meaning a stock installation with no plugins is exploitable. The attack requires no authentication, no user interaction, and no special configuration. Any anonymous visitor can send a crafted request and achieve remote code execution.

WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected. Version 6.8.x carries only the SQL injection (CVE-2026-60137), patched in 6.8.6, but lacks the batch route confusion needed for RCE. The RCE chain exists only from version 6.9 onward, released December 2, 2025.

WordPress pushed forced automatic updates on July 18 to accelerate patching. However, sites that disabled auto-updates or run managed hosting with delayed update cycles remain exposed until manually patched.

Vulnerability Details

CVE-2026-60137: SQL Injection in WP_Query (CVSS 9.1+)

The injection resides in the author__not_in parameter of WP_Query. When a string is passed instead of an array, the validation check that expects an array is bypassed, allowing raw SQL to enter the query. This bug dates back to WordPress 6.8.

CVE-2026-63030: REST API Batch Route Confusion (CVSS 7.5)

Introduced in WordPress 6.9, the /wp-json/batch/v1 endpoint processes multiple sub-requests in a single call. It tracks sub-requests in two parallel arrays. An error in one sub-request desynchronizes the arrays by one index, causing a subsequent request to execute under a different handler's authorization context.

An attacker nests the SQL injection payload inside a batch request. The route confusion walks the payload past the endpoint allow-list and into the vulnerable WP_Query parameter, all without authentication.

The Chain

1. Attacker sends a POST request to /wp-json/batch/v1
2. Batch contains a sub-request targeting the vulnerable WP_Query parameter
3. Route confusion misroutes the sub-request to bypass authorization checks
4. SQL injection executes, enabling arbitrary database writes
5. Attacker writes a PHP webshell to the filesystem via INTO OUTFILE or similar technique
6. Remote code execution achieved

Critical Nuance: Persistent Object Cache

Cloudflare's analysis revealed the code-execution path only works when no persistent object cache (Redis, Memcached) is configured. A default WordPress install has no object cache, so default installations are fully exposed. Sites using Redis or Memcached as a persistent object cache may avoid the RCE path, but the underlying SQL injection remains exploitable.

Impact Assessment

Factor	Details
Attack Vector	Network (HTTP)
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Changed (core + database)
Confidentiality	High (full database read)
Integrity	High (code execution, file write)
Availability	High (can destroy site)

WordPress rates the chain Critical. The CVE record scores it 7.5 (High) because the scoring model treats the batch confusion as a parsing flaw and credits the SQL injection separately at 9.1+. Track both CVEs.

Over 500 million WordPress sites exist globally. The exposed subset (versions 6.9.0-6.9.4 and 7.0.0-7.0.1) represents sites updated within the last eight months. No confirmed exploitation has been reported to CISA KEV as of July 18, but public proof-of-concept code exists on GitHub.

Affected Systems

WordPress Version	Status	Fixed In
6.8.0 - 6.8.5	SQLi only (no RCE)	6.8.6
6.9.0 - 6.9.4	Full RCE chain	6.9.5
7.0.0 - 7.0.1	Full RCE chain	7.0.2
7.1 beta 2	Patched	7.1 beta 2+

Check your version immediately: Dashboard > Updates, or wp core version via WP-CLI.

Mitigation & Patching

Immediate Action: Update WordPress

Emergency Mitigations (If Update Is Delayed)

All mitigations block anonymous access to the batch endpoint. They may break legitimate integrations (headless CMS, mobile apps, third-party services using the REST API).

1. WAF Rule (Cloudflare, AWS WAF, ModSecurity) Block both patterns:

• Path: /wp-json/batch/v1
• Query string: rest_route=/batch/v1

Cloudflare's managed WAF ruleset now includes this block.

2. Disable WP REST API Plugin Install and activate Disable WP REST API. This blocks all unauthenticated REST access.

3. Drop-in Plugin (Searchlight's Recommendation) Create /wp-content/plugins/disable-batch-api-for-unauth.php:

Activate via Plugins > Installed Plugins.

Detection

Indicators of Compromise

• Unexpected files in wp-content/uploads/ with .php extension
• Unknown admin users in wp_users table
• Suspicious entries in wp_options (e.g., injected scripts)
• Webshell patterns in access logs: POST /wp-json/batch/v1 with nested SQL payloads

Log Queries

NGINX/Apache Access Logs:

WordPress Debug Log (if enabled):

Scanner Support

• Rapid7 InsightVM/Nexpose: Authenticated checks released July 20
• Qualys: QID signature pending
• Tenable/Nessus: Plugin in development
• WPScan: Updated definitions available via wpscan --update

Frequently Asked Questions

Does this affect WordPress.com hosted sites?

No. WordPress.com infrastructure was patched before public disclosure. Only self-hosted installations are affected.

Is my site safe if I use a managed host (WP Engine, Kinsta, Pantheon)?

Most managed hosts applied forced updates on July 18. Verify with your provider or check your version in the dashboard.

Can a WAF fully protect me?

A properly configured WAF blocking both /wp-json/batch/v1 and rest_route=/batch/v1 stops the RCE chain. It does not fix the underlying SQL injection, which could be exploited through other vectors if discovered.

What if I cannot update because of plugin compatibility?

Apply the drop-in plugin mitigation immediately. Test plugin compatibility in staging, then update WordPress core. The risk of RCE far exceeds typical plugin breakage.

Does this affect WooCommerce or other plugins?

No. The vulnerability is in WordPress core. However, any plugin that registers custom REST endpoints using the batch framework could theoretically introduce similar confusion bugs. Audit custom endpoints.

How do I know if I was already compromised?

Check for unknown admin users, unexpected PHP files in uploads, and anomalous database entries. Restore from a known-good backup if compromise is suspected, then update and rotate all credentials.

Key Takeaways

1. Update immediately: WordPress 6.9.5 or 7.0.2 patches the full chain.
2. Default installs are exposed: No persistent object cache means the RCE path works out of the box.
3. Two bugs, two CVEs: Track both CVE-2026-63030 and CVE-2026-60137. The CVE score alone understates the risk.
4. Public exploit exists: Proof-of-concept code is on GitHub. The window for safe patching is measured in hours.
5. Forced updates are rolling: WordPress triggered auto-updates on July 18. Verify your site actually updated.
6. Mitigations are stopgaps: WAF rules and the drop-in plugin buy time but can break legitimate API integrations.

Conclusion

wp2shell is the most severe WordPress core vulnerability in years. A two-bug chain in the REST API batch framework and WP_Query turns an anonymous HTTP request into full server compromise. The fix is a single core update. If you run WordPress, update now. If you manage WordPress for clients, update all sites today. The exploit is public, the patch is available, and every unpatched site is a target.

---

Sources:

• Searchlight Cyber wp2shell Disclosure
• The Hacker News: New wp2shell WordPress Core Flaw
• WordPress Security Advisory GHSA-ff9f-jf42-662q
• Cloudflare WAF Rules for WordPress Vulnerabilities
• wp2shell.com Vulnerability Checker