WordPress wp2shell: How Two Core Flaws Let Attackers Run Code Without Logging In
By Necolas Hamwi
July 18, 2026 | aratech Blog
The Short Version
An anonymous HTTP request can now take over a WordPress site. No password, no plugin, no misconfiguration — just a bare WordPress install. Two newly chained vulnerabilities, CVE-2026-63030 and CVE-2026-60137, turn a standard WordPress 6.9 or 7.0 site into a remote-code-execution target. The flaws are in core, the exploit is public, and patches are already rolling out via forced auto-updates.
If you run WordPress for a client, a portfolio, or an internal tool, this one matters.
What Is wp2shell?
Security researcher Adam Kues (Searchlight Cyber / Assetnote) discovered and published a two-bug chain that bypasses authentication entirely. The name wp2shell comes from the attack's outcome: an unauthenticated attacker sends a crafted request and gets a shell — full code execution on the server.
The chain works like this:
- CVE-2026-60137 — A SQL injection in WordPress core lets an attacker manipulate the database through an unauthenticated request.
- CVE-2026-63030 — A REST API batch-route confusion vulnerability lets the attacker chain that SQL injection into privilege escalation and remote code execution.
Individually, each bug is serious. Together, they are catastrophic because the attack requires zero preconditions: no authenticated user, no administrator access, no vulnerable plugin.
Who Is Affected?
The affected versions are specific:
If your site runs any version from 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1, it was exploitable until WordPress shipped forced auto-updates on Friday, July 17, 2026.
The good news: WordPress enabled forced updates through its auto-update system, so many sites are already patched. The bad news: any site with auto-updates disabled, or any site that missed the forced push, remains vulnerable.
Why This Is Different From Other WordPress Flaws
Most WordPress vulnerabilities live in plugins or themes. A core flaw is rarer and more dangerous because:
- Every install is a target. No plugin audit can catch it.
- The attack surface is universal. REST API is enabled by default.
- Exploitation is trivial. A working proof-of-concept is already public on GitHub.
- Patching is not optional. Waiting for your next maintenance window is a risk.
The wp2shell mechanism was published in full on July 17, and a working PoC went live the same day. That means exploit code is now available to every attacker, not just the original researcher.
What Should You Do Right Now
-
Check your version. Log into wp-admin and look at the bottom-right corner, or run
wp core versionvia WP-CLI. If you are on 6.9.x below 6.9.5 or 7.0.x below 7.0.2, you are exposed. -
Update immediately. WordPress 6.9.5 and 7.0.2 close both CVEs. If auto-updates are off, update manually now.
-
Verify the patch landed. After updating, confirm the version number. Do not assume the forced update reached your host.
-
Scan for indicators of compromise. Because this flaw allows unauthenticated access, check your access logs for unexpected REST API requests to
/wp-json/wp/v2/or/wp-json/wp/v2/usersbefore the patch date. -
Harden your REST API. If you do not use the REST API, consider restricting it with a firewall rule or a security plugin. This does not fix the flaw, but it reduces exposure to similar future bugs.
The Bigger Picture: Core Software Is Not Inherently Safe
Organizations often treat WordPress as "just a CMS" and assume security is a plugin problem. wp2shell proves that assumption wrong. The most trusted software on the internet can ship a pre-authentication RCE in core, and the only thing standing between you and compromise is whether your update mechanism worked on a Friday afternoon.
For enterprises, the lesson is the same as it is for operating systems: patch cadence is a security control. If your team does not have a documented, tested WordPress core update policy, this is your reminder to build one.
About the Researcher
Adam Kues reported the batch-route bug through WordPress's HackerOne program. The SQL injection was reported separately by researchers TF1T, dtro, and haongo. Searchlight Cyber, the attack-surface management arm where Kues works, published the write-up under the name wp2shell and is still holding its full technical details while pointing site owners to a checker at wp2shell.com.
TL;DR
- Two WordPress core flaws chain into unauthenticated remote code execution.
- Affects 6.9.0–6.9.4 and 7.0.0–7.0.1.
- Public PoC is live. Forced auto-updates shipped July 17.
- If you manage WordPress sites, update to 6.9.5 or 7.0.2 today.
Necolas Hamwi is CTO and Founder of aratech. He writes about cybersecurity, AI, and the infrastructure choices that shape modern digital business.