WordPress wp2shell RCE (CVE-2026-63030): Patch Now

On July 17, 2026, WordPress shipped security releases 7.0.2 and 6.9.5. They patch a serious vulnerability nicknamed "wp2shell": on a default install, with no login and no plugins, a single anonymous HTTP request can execute code on the server (pre-authentication RCE). On July 18, CVE IDs were assigned, the full exploit mechanism was published, and a working proof-of-concept (PoC) went public. If your site runs an affected version, updating is the top priority. Check your core version first, and if it is in the 6.9 or 7.0 line, update to the latest immediately.

wp2shell is not one bug but two chained together. One half (a SQL injection) has existed since the 6.8 line, but the other half (a flaw in REST API batch handling) that elevates it into an unauthenticated RCE only exists from 6.9 onward.

*WordPress has also enabled forced updates via its auto-update system. But environments with auto-updates disabled, or behind a reverse proxy / WAF, must be checked manually.*

- CVE-2026-60137 (SQL injection): Passing a string instead of the expected array to WP_Query's author__not_in parameter bypasses validation and injects raw values into the SQL query
- CVE-2026-63030 (REST API batch-route confusion): The /wp-json/batch/v1 endpoint processes multiple sub-requests at once; misaligned error handling shifts array indices, letting an unauthenticated request reach the vulnerable parameter

Chained, an anonymous request bypasses the auth check via the batch endpoint, hits the SQL injection, and ultimately reaches code execution. WordPress rated the RCE chain Critical, and default installs without a persistent object cache are considered especially exposed. The batch-route bug was identified by Adam Kues of Assetnote/Searchlight Cyber.

- Check the version: Confirm your core version under Dashboard > Updates, or in the site footer
- Update immediately: 6.9.x to 6.9.5, 7.0.x to 7.0.2, 6.8.x to 6.8.6
- Back up before updating: For production sites, back up files and database first
- Check auto-update settings: Verify you have not disabled WP_AUTO_UPDATE_CORE (if disabled, a manual update is mandatory)
- Look for signs of compromise: Unfamiliar admin accounts, new PHP files, and abnormal POSTs to /wp-json/batch/v1 in access logs

If an immediate update is difficult — for example, you need to verify behavior in staging — the following mitigations buy time. But the real fix is updating core; treat mitigations only as a stopgap until then.

- Block the batch endpoint: At the WAF or web server level, deny access to /wp-json/batch/v1 and rest_route=/batch/v1
- Restrict anonymous REST API access: Limit REST API access to authenticated users (a vendor-provided drop-in plugin is one option)
- Managed WAF virtual patches: Some managed WAFs offer protection rules for this vulnerability; check whether they are applied

Core vulnerabilities that are dangerous even on default installs cause the longest damage on neglected sites. With routine update operations in place, forced or manual updates close the hole within hours; sites left unupdated become easy scan targets once a PoC is public. For what continuous WordPress operation should involve, see the practice of WordPress maintenance; for the broader risk of stopping updates, see preparing for end of life. For first response if a breach does occur, see the first 24 hours after a data breach.

wp2shell (CVE-2026-63030 / CVE-2026-60137) is a serious WordPress core vulnerability leading to code execution with no login and no plugins. Fixes shipped on July 17 and a PoC went public on July 18. Affected lines are 6.9.x and 7.0.x (6.8.x for the SQLi alone). The action is simple: back up, then update to the latest immediately. If you cannot update right away, buy time by blocking the batch endpoint, then patch core as soon as possible. Routine update operations make the biggest difference in how much damage an emergency like this causes.