wp2shell: Critical WordPress Vulnerability and What to Do Now

wp2shell is the name given to a critical vulnerability chain in WordPress Core. The issues are identified as CVE-2026-63030 and CVE-2026-60137. Combined, they can allow an unauthenticated attacker to execute code on the server, including on a standard WordPress installation with no vulnerable plugin.

WordPress released the fixes on July 17, 2026 and recommends updating immediately. Because of the severity, the WordPress team also enabled forced automatic updates for affected versions. An automatic update can still fail, so manual verification remains essential.

What is wp2shell?

wp2shell is a pre-authentication remote code execution vulnerability, commonly shortened to RCE. In plain language, an attacker may be able to make the server execute instructions without owning a WordPress account and without knowing a password.

The chain involves two separate security flaws:

• CVE-2026-63030: a route-confusion issue in the REST API batch endpoint;
• CVE-2026-60137: an SQL vulnerability associated with the author__not_in parameter in WP_Query.

The official WordPress advisory describes the combination as capable of leading to SQL injection and remote code execution. CVE-2026-63030 received a CVSS 3.1 score of 9.8 from CNA WPScan, placing it in the critical category.

Unlike many WordPress incidents, this problem is in the platform core. It does not require a particular plugin or theme. Searchlight Cyber states that the attack has no preconditions and can affect a stock WordPress installation.

Which WordPress versions are affected?

You do not need to switch major branches solely for this security fix. If you run WordPress 6.9, install 6.9.5. If you run 7.0, install 7.0.2.

How to check whether your website is vulnerable

Method 1: check the version in WordPress

1. Sign in to the WordPress dashboard.
2. Open Dashboard → Updates.
3. Note the installed WordPress version.
4. If you see 6.9.0–6.9.4 or 7.0.0–7.0.1, create a backup and update immediately.
5. Reload the Updates screen and confirm the new version number.

Method 2: check with WP-CLI

If you have SSH access and know how to use WP-CLI, run:

wp core version

To update WordPress Core and the database:

wp core update
wp core update-db

If you are not comfortable using the terminal, use the WordPress dashboard or contact your technical administrator. A command run in the wrong directory may check a different installation from your live website.

Method 3: use the Searchlight Cyber checker

The researchers published the wp2shell vulnerability checker. It can test the installation’s behaviour even when the WordPress version is not publicly displayed.

Your one-hour action plan

1. Create a complete backup

Back up both the files and the database. Confirm that the backup finished and that the archive is accessible. A message saying that a backup is scheduled does not prove that a usable copy exists.

2. Update WordPress Core

Open Dashboard → Updates and use the official update button. Do not download WordPress archives from third-party websites. Official packages are available through the dashboard and WordPress.org.

3. Confirm the installed version

After the update, reopen the Updates screen. Confirm that you run 6.9.5 or 7.0.2, depending on your branch. Then test the homepage, contact form, login, checkout, and any other business-critical function.

4. Inventory every WordPress installation

Check the production site, staging environments, subdomains, test installations, and old campaign websites. A forgotten installation may share the same hosting account and expose other websites.

5. Update plugins and themes

These updates do not fix wp2shell because the vulnerability is in WordPress Core. They do reduce other attack surfaces and should be applied in a controlled process with a backup and post-update testing.

6. Review users and active sessions

Review every account with the Administrator role. Remove unknown users and change privileged account passwords if the website remained exposed. Enable multi-factor authentication and use unique passwords.

For a complete prevention, monitoring, update, and recovery system, use our complete WordPress security and maintenance guide.

What if you cannot update immediately?

Searchlight Cyber recommends temporarily blocking anonymous access to the REST Batch API. Both route formats must be covered:

• /wp-json/batch/v1
• /?rest_route=/batch/v1

The block can be applied at WAF or web-server level. Anonymous access to the REST API can also be restricted temporarily. These measures may affect the WordPress editor and integrations that depend on the API.

How to check whether the site was compromised

Updating prevents future exploitation of the vulnerability, but it does not automatically remove changes made before the update. Review the following warning signs:

• WordPress administrators you do not recognise;
• new or modified PHP files inside wp-content/uploads/;
• unknown plugins or must-use plugins;
• unauthorised changes to wp-config.php or .htaccess;
• unknown scheduled cron jobs;
• redirects, spam pages, or unfamiliar Google results;
• malware warnings from your host or Google Search Console;
• unusual POST requests to the batch route in server logs.

Compromise is not always visible. Our guide to the invisible signs of a hacked WordPress site explains what to review before declaring an incident closed.

If you find serious evidence, avoid superficial cleanup. Isolate the website, preserve the logs, and request a technical investigation. Restoring a known-clean backup, then updating and rotating credentials, may be safer than deleting a few suspicious files. Prepare a WordPress disaster recovery plan before an incident occurs.

How the attack works, without exploitation details

The WordPress REST API can group several requests into one batch request. CVE-2026-63030 creates confusion between the route that is validated and the route that is executed. Combined with the CVE-2026-60137 SQL issue, this mismatch can lead to remote code execution.

Searchlight Cyber stated that full technical details were not released immediately, giving website owners time to patch. For the same reason, this article does not include payloads, exploitation steps, or instructions for bypassing security controls.

For a website owner, the important technical conclusion is simple: a firewall may reduce risk, but updating WordPress Core is the actual fix.

Why automatic updates are not enough

WordPress enabled forced updates for affected websites. This protects many installations, but it does not guarantee success on every server. Updates may fail because of:

• incorrect file permissions;
• insufficient disk space;
• automatic updates being disabled in configuration;
• a security plugin blocking writes to Core directories;
• an interrupted update process;
• an old or forgotten installation that is no longer monitored.

The difference between automatic updates and professional WordPress maintenance is verification. Maintenance includes tested backups, controlled updates, business-function checks, monitoring, and a rollback path.

Frequently asked questions about wp2shell

What is wp2shell?

wp2shell is the name of a critical vulnerability chain involving CVE-2026-63030 and CVE-2026-60137. It can allow unauthenticated remote code execution on specific WordPress Core versions.

Which WordPress versions are vulnerable?

WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 are affected. Update to 6.9.5 or 7.0.2. The 6.8 branch is affected only by the separate SQL issue, fixed in 6.8.6.

Am I protected if automatic updates are enabled?

The update may have been applied automatically, but you must confirm the installed version. Automatic updates can fail without an obvious warning on the public website.

Does a security plugin block wp2shell?

There is no guarantee. Some firewalls may apply temporary rules, but the vulnerability is in WordPress Core. The recommended protection is the official patched release.

Should staging websites be updated too?

Yes. Check every WordPress installation, including test sites, subdomains, and old projects. A secondary installation may share the same hosting account as the production website.

Does the update repair an already compromised site?

No. The update closes the vulnerability but does not automatically remove accounts, files, or scheduled tasks added earlier. A suspicious website needs a controlled investigation and recovery process.

Official and technical sources

• WordPress 7.0.2 Security Release
• Searchlight Cyber’s original wp2shell report
• WordPress advisory for CVE-2026-63030
• NVD record for CVE-2026-63030