WordPress Core “wp2shell” RCE Flaws Exposed: Patch Now to Avoid Catastrophic Consequences
A devastating pair of vulnerabilities, dubbed “wp2shell,” has been discovered in WordPress Core, allowing attackers to execute malicious code on affected sites without requiring administrator credentials. The critical flaws, affecting over 500 million websites, have already spawned public proof-of-concept exploits, making it imperative for administrators to patch their sites immediately.
The wp2shell attack chain involves two independent vulnerabilities: a REST API batch-route confusion flaw (CVE-2026-63030) and an SQL injection issue in the ‘author__not_in’ parameter of ‘WP_Query’ (CVE-2026-60137). These flaws can be combined to enable pre-authentication remote code execution, giving attackers unfettered access to vulnerable sites. The full attack chain affects WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1.
Searchlight Cyber, the security research team that discovered the flaws, has deliberately withheld technical details to allow administrators time to patch their sites. Instead, they have created a website (wp2shell.com) that allows admins to test whether their installations are vulnerable. This temporary measure is meant to be used until systems can be updated.
The WordPress security team has taken swift action to address the issue, enabling forced automatic security updates for supported installations running affected versions and urging site owners to update to WordPress 7.0.2 or 6.9.5 immediately. Cloudflare has also deployed Web Application Firewall (WAF) protections for both vulnerabilities across all plans, including free accounts.
However, administrators should note that these mitigations are only temporary measures until systems can be updated. Searchlight Cyber recommends installing a plugin that blocks anonymous access to the REST API entirely or blocking specific URLs at a WAF level as a stopgap solution.
The fact that multiple public proof-of-concept exploits have been published on GitHub raises concerns about the potential for widespread exploitation. These publicly available exploits combine the two vulnerabilities to extract WordPress password hashes via SQL injection, then crack an administrator password to log in, upload a malicious plugin, and execute commands. While some proof-of-concept exploits claim to achieve pre-authentication remote code execution without requiring administrator credentials, the exact attack chain remains unclear.
In light of this situation, we urge all administrators to take immediate action:
* Update your WordPress installation to version 7.0.2 or 6.9.5 as soon as possible.
* Use a reputable security plugin to scan for vulnerabilities and patch any weaknesses.
* Consider implementing additional security measures, such as web application firewalls (WAFs) or intrusion detection systems (IDS), to detect and prevent potential attacks.
Remember that patching your site is the only foolproof way to avoid catastrophic consequences. Don’t wait – take action now to protect your website from this devastating vulnerability.
Source: Bleeping Computer — 2026-07-18