WP2Shell: An Unauthenticated Attacker Can Own Your WordPress Site Right Now. Patch to 7.0.2 Immediately.

On Friday July 17, 2026, Adam Kues of Searchlight Cyber's attack surface management arm Assetnote disclosed WP2Shell through WordPres...

On Friday July 17, 2026, Adam Kues of Searchlight Cyber's attack surface management arm Assetnote disclosed WP2Shell through WordPress's HackerOne program. The writeup is unambiguous: "no preconditions and can be exploited by an anonymous user." No account. No plugin. No user interaction. A default WordPress installation running versions 6.9.0 through 7.0.1 can be taken from zero access to a rogue administrator with code execution in a single chained attack. Public proof-of-concept exploits went up on GitHub within hours of disclosure. In-the-wild exploitation was reported within 24 hours.

WordPress took the unusual step of force-pushing patches to all supported installations through its auto-update system. Cloudflare simultaneously released WAF protections for sites behind its service. Searchlight Cyber published a free scanner at wp2shell.com so administrators can check exposure. The patches exist. The scanner exists. The only remaining question is whether you have applied them.

How WP2Shell Actually Works The Two-Vulnerability Chain

WP2Shell is two bugs, not one, and understanding the chain matters for understanding why it is so serious. The first bug CVE-2026-63030 is a route confusion condition in the WordPress REST API batch endpoint. When the batch endpoint processes a request, a flaw in how it routes attacker-controlled input causes it to be misrouted or interpreted incorrectly, reaching unintended code paths. On its own, this is the authentication bypass: it causes the SQL injection in CVE-2026-60137 to be reachable without any credentials.

The second bug CVE-2026-60137 is a SQL injection in the author__not_in parameter of WP_Query. On its own, this injection is restricted to authenticated users only, so its impact is limited. But CVE-2026-63030 bypasses that restriction by misrouting the request before authentication is checked. Chained together: an anonymous HTTP request goes in, the batch-route confusion bypasses authentication, the SQL injection runs unauthenticated, the attacker dumps the database, cracks or uses the stolen admin password hash, logs in as administrator, and uploads a webshell. Complete site compromise. No plugins needed. Works on a bare default install.

The 6.8 branch has a separate exposure worth noting. WordPress 6.8 is only affected by CVE-2026-60137, not the full RCE chain but the SQL injection alone is still a serious vulnerability, and the fix has been backported to version 6.8.6. Organizations running 6.8.x should upgrade to 6.8.6 even though they are not exposed to the full unauthenticated RCE.

Which Versions Are Affected and What to Update To

The affected versions and their fixes are specific. For the full WP2Shell RCE chain: WordPress 6.9.0 through 6.9.4 update to 6.9.5 or later. WordPress 7.0.0 through 7.0.1 update to 7.0.2 or later. For the SQL injection component only: WordPress 6.8.0 through 6.8.5 update to 6.8.6 or later. If you are running any version below 6.8, you are already well behind on security updates and should upgrade to the latest stable release immediately.

WordPress force-pushed the update to installations with automatic updates enabled meaning many sites may already be patched without administrator action. However, Rapid7 specifically notes that administrators should verify each internet-facing WordPress installation has successfully upgraded rather than assuming the auto-update completed. Auto-update failures are silent. Check your WordPress version in the admin dashboard or wp-admin/about.php and confirm you are on a fixed version before proceeding.

The persistent object cache condition from Cloudflare's advisory is worth noting for site owners using caching: CVE-2026-63030 can be exploited through the REST API batch endpoint when a persistent object cache is not enabled. If your site uses a persistent object cache plugin Redis, Memcached, or similar that reduces but does not eliminate your exposure. The fix is still the patch, not the cache configuration.

Why This Is More Serious Than a Typical WordPress Vulnerability

The vast majority of WordPress security issues live in plugins or themes. WP2Shell is in WordPress itself which means it reaches a bare install with nothing added. That distinction is critical. Organizations that keep plugins updated, audit themes regularly, and follow WordPress security hygiene are still exposed if they have not patched Core. The plugin-security model that most WordPress administrators operate under does not protect against Core vulnerabilities.

The speed of proof-of-concept availability compounds the urgency. BleepingComputer confirmed that public exploits went live on GitHub within hours of Searchlight Cyber's disclosure. VulnCheck noted early reports of in-the-wild activity emerging within 24 hours. Indusface's analysis marks this as a same-day patch priority for any internet-facing WordPress deployment. The window between disclosure and active exploitation for high-severity Core vulnerabilities has compressed to hours, not days, as automated scanners probe millions of sites continuously.

Searchlight Cyber withheld full technical exploit details to give site owners time to patch which is responsible disclosure practice. The free scanner at wp2shell.com lets administrators check exposure without needing to understand the technical mechanism. That combination withheld technical details plus a free public scanner is the right approach for a vulnerability of this severity, and it is worth crediting Searchlight and WordPress for executing the coordinated disclosure well.

What to Do Right Now Step by Step

Step one: run the free scanner at wp2shell.com against every WordPress installation you manage. This tells you immediately whether you are on a vulnerable version. Step two: if vulnerable, update to 6.8.6, 6.9.5, or 7.0.2 depending on your branch. Do not use workarounds Rapid7 specifically states workarounds are not recommended at this time. The patch is the fix.

Step three: verify the update completed. Do not assume auto-update succeeded. Log into wp-admin and confirm the version shown in the dashboard matches a fixed release. Step four: if you are behind Cloudflare, verify WAF rules for CVE-2026-63030 and CVE-2026-60137 are active Cloudflare released these simultaneously with disclosure. Step five: review web server access logs for POST requests to the REST API batch endpoint specifically /wp-json/batch/v1 from before you patched. Unusual traffic to that endpoint in the past 48 hours is a compromise indicator.

If you believe your site may already be compromised: look for newly created administrator accounts in wp-admin/users.php. Look for unfamiliar files in wp-content/uploads and wp-content/themes webshell files are typically PHP files with names that blend in. Check file modification timestamps. Rapid7's InsightVM and Nexpose customers can assess exposure with authenticated vulnerability checks available in the July 20 content release. The Eye Security defenders' guide at labs.eye.security is the most thorough public resource for detection and response steps.

Frequently Asked Questions

Q: What is WP2Shell and how serious is it?

WP2Shell is a two-vulnerability chain in WordPress Core disclosed July 17, 2026, by Adam Kues of Searchlight Cyber. It combines CVE-2026-63030 REST API batch-route confusion with CVE-2026-60137 SQL injection to let an unauthenticated attacker achieve remote code execution on a default WordPress install no plugins needed. Public exploits went live on GitHub within hours. In-the-wild exploitation was reported within 24 hours.

Q: Which WordPress versions are affected?

Full RCE chain: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. SQL injection only: WordPress 6.8.0–6.8.5. Fixed versions: 6.8.6, 6.9.5, and 7.0.2. WordPress force-pushed patches to auto-update installations.

Q: How can I check if my site is vulnerable?

Use the free scanner at wp2shell.com published by Searchlight Cyber. You can also check your version at wp-admin/about.php. If you are on any version between 6.8.0 and 7.0.1 inclusive, patch immediately.

Q: I have auto-updates enabled. Am I already patched?

Possibly but verify. Auto-update failures are silent. Rapid7 specifically recommends confirming each internet-facing installation has successfully upgraded rather than assuming. Log into wp-admin and confirm you are on 6.8.6, 6.9.5, or 7.0.2.

References

1. VulnCheck. WP2Shell Vulnerabilities: CVE-2026-60137 and CVE-2026-63030. July 17, 2026. vulncheck.com
2. BleepingComputer. WordPress Core WP2Shell RCE flaws get public exploits, patch now. July 2026. bleepingcomputer.com
3. The Hacker News. New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code. July 2026. thehackernews.com
4. Rapid7. CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core. July 2026. rapid7.com
5. Eye Security. wp2shell: a defender's guide (CVE-2026-63030 + CVE-2026-60137). July 2026. labs.eye.security