Critical Alert: "wp2shell" Vulnerability Exploded Across Unpatched WordPress Core Sites

A critical vulnerability dubbed “wp2shell” is actively being exploited in the wild. Unlike typical security scares caused by outdated third-party plugins, wp2shell exists in WordPress Core itself. It allows unauthenticated, anonymous bad actors to remotely execute code and take full control of affected sites.

Here is what you need to know about the exploit, who is affected, and the exact steps to secure your site immediately.

What is “wp2shell”?

Disclosed in mid-July 2026, wp2shell isn’t just a single bug—it is a lethal “exploit chain” combining two distinct flaws in WordPress Core:

1. REST API Route Confusion (CVE-2026-63030): A flaw in how WordPress handles batch endpoints (/wp-json/batch/v1). When an attacker sends nested or malformed requests, the API loses sync. This trick bypasses permission checks entirely, letting unauthenticated requests slip through as if they were public queries.
2. SQL Injection via WP_Query (CVE-2026-60137): Once past the REST API barrier, the attacker targets the author__not_in parameter during post queries. Because input validation was bypassed in step 1, malicious SQL payloads reach the database unsanitized.

The End Result? Full Site Takeover

By combining these two steps, an anonymous attacker on the internet can inject database entries, create a rogue Administrator account, upload a malicious PHP webshell, and gain complete control over your web server all in a matter of seconds.

Am I Affected?

Check your site’s current WordPress Core version immediately.

• Vulnerable Versions:

  • WordPress 7.0.0 through 7.0.1
  • WordPress 6.9.0 through 6.9.4
  • Note: Legacy installations on version 6.8.x are affected by the SQL injection flaw but lack the route confusion component needed for the full remote code execution chain.

• Patched (Safe) Versions:

  • WordPress 7.0.2
  • WordPress 6.9.5
  • WordPress 6.8.6

Action Plan: 3 Steps to Secure Your Site

Because proof-of-concept scripts are publicly circulating and automated bots are actively probing the web, action is required.

Step 1: Update WordPress Core Immediately

Log into your WordPress Dashboard, navigate to Dashboard > Updates, and click Update Now to apply WordPress 7.0.2 (or 6.9.5). Do not assume auto-updates ran successfully—verify the version yourself.

Step 2: Block Anonymous REST Batch Endpoints (If Delayed)

If you cannot update Core immediately due to legacy staging or client approval dependencies, set up temporary Web Application Firewall (WAF) or Nginx/Apache edge rules to block access to the /wp-json/batch/v1 endpoint. Be sure to block both clean URL paths and /?rest_route=/batch/v1 variants.

Step 3: Check for Indicators of Compromise (IoCs)

Even if your site is now patched, inspect your site to ensure you weren’t targeted prior to updating:

• Users: Go to Users > All Users and look for unauthorized admin accounts (automated attack scripts often create admin accounts beginning with w2s_).
• Plugins: Inspect wp-content/plugins/ via FTP/File Manager for rogue folders or unfamiliar PHP files.
• Logs: Review server access logs for repeated HTTP 207 Multi-Status responses targeting /wp-json/batch/v1.

Final Thoughts

Core vulnerabilities like wp2shell highlight why maintenance, automated backups, and edge WAF protection are essential components of modern site administration. Take a few minutes today to check your sites and ensure your core installations are running the latest security releases!

Image By: Deng Xiang