WordPress Users Urged to Patch Critical Vulnerabilities as Public Exploits Emerge
A severe security threat has emerged for millions of WordPress users, with two critical vulnerabilities in the content management system’s core code allowing unauthenticated attackers to execute malicious code on affected sites. The flaws, known as wp2shell, have been publicly exploited and patched, but administrators are still racing against time to update their installations.
The issue affects over 500 million websites that use WordPress, a staggering figure that underscores the potential impact of this vulnerability. According to Searchlight Cyber, the company that discovered the flaw, an attacker can exploit the wp2shell vulnerabilities by targeting a default WordPress installation with no plugins or preconditions required. This means that even sites with basic security measures in place may be vulnerable.
The wp2shell attack chain consists of two independent flaws: a REST API batch-route confusion vulnerability (CVE-2026-63030) and an SQL injection flaw (CVE-2026-60137). While both vulnerabilities can be exploited separately, they can also be combined to achieve remote code execution against WordPress 6.9.x and 7.0.x installations. The full attack chain has been fixed in WordPress 6.9.5 and 7.0.2.
The WordPress security team has taken swift action to address the issue, enabling forced automatic security updates for supported installations running affected versions. Site owners are urged to update their sites immediately, as this is a critical security release that cannot wait. The company also recommends blocking anonymous access to the REST API entirely or implementing Web Application Firewall (WAF) protections at a network level.
Cloudflare has stepped in to help mitigate the impact of the vulnerability by deploying WAF protections for both flaws across all plans, including free accounts. While these rules can reduce exposure while customers update, they are not a substitute for patching and should only be used as a temporary measure.
The release of public proof-of-concept exploits on GitHub has further highlighted the severity of the situation. Some of these exploits combine the two vulnerabilities to extract WordPress password hashes via SQL injection, then crack an administrator password to log in, upload a malicious plugin, and execute commands. However, other proof-of-concept exploits claim to achieve pre-authentication remote code execution without requiring administrator credentials.
To protect their sites from this critical vulnerability, administrators should take immediate action:
* Update your WordPress installation to version 7.0.2 or 6.9.5 as soon as possible.
* If you cannot update immediately, consider installing a plugin that blocks anonymous access to the REST API entirely or implement WAF protections at a network level.
* Use cloud-based security services like Cloudflare’s WAF protections to reduce exposure while updating.
Remember, patching is the only surefire way to prevent an attacker from exploiting these vulnerabilities. Don’t wait – update your WordPress installation now and ensure the security of your site.
Source: Bleeping Computer — 2026-07-18