wp2shell (CVE-2026-63030): A WordPress Core Pre-Auth RCE, and What to Do Now

wp2shell is a pre-authentication remote code execution flaw in WordPress Core, meaning an anonymous request, with no login and no vulnerable plugin required, can run code on a default install. It chains two bugs disclosed on July 17, 2026: a SQL injection in WordPress's WP_Query (CVE-2026-60137) and a REST API batch-route confusion (CVE-2026-63030). Public exploits landed within hours, real-world attacks were confirmed within days, and CISA added both bugs to its Known Exploited Vulnerabilities catalog. If you run a self-hosted WordPress site on 6.9.x or 7.0.x, the only safe assumption is that you are a target: update to 6.9.5 or 7.0.2 immediately, then check whether someone got in before you patched.

What is wp2shell, and why is it so bad?

wp2shell is the name researchers at Searchlight Cyber gave to a two-bug chain in WordPress Core itself, not a plugin or theme. That distinction is what makes it serious. A plugin flaw affects the sites that installed that plugin; a Core flaw affects a bare, freshly installed WordPress with nothing added. WordPress runs an estimated 500 million-plus sites, and any of them on an affected version exposes the vulnerable endpoint by default.

The severity sits in the chain. Tenable rates the REST batch-route bug, CVE-2026-63030, at CVSS 9.8, and the SQL injection, CVE-2026-60137, at 5.9. On their own each is a problem; together they let an unauthenticated attacker go from a single HTTP request to a full administrator takeover. No credentials, no user interaction, no second foothold needed.

How the exploit chain works

The clever part is how the two bugs cover for each other. WordPress's author__not_in query parameter is interpolated directly into raw SQL when it is passed as a scalar string — a classic injection, except normal request validation rejects the malformed input before it reaches the database.

That is where the batch API comes in. The /wp-json/batch/v1 endpoint validates and executes sub-requests in two separate loops. When wp_parse_url() fails on a crafted sub-request path, the error is recorded in the validation array but the request is not removed from the execution array. The two lists fall out of sync, validation is skipped, and a recursive batch call smuggles a UNION-based SQL injection straight through. From there the exploit chains WordPress internals to create an administrator account, logs in with it, and uploads a malicious plugin, and that plugin is the code-execution payload. One request in, a web shell out.

Which WordPress versions are affected?

The full RCE chain only works where the batch route exists, which WordPress introduced in 6.9. The SQL injection alone reaches further back. Patched releases shipped across all three supported branches.

Branch	Affected versions	Fixed in	Exposure
7.0.x	7.0.0 – 7.0.1	7.0.2	Full pre-auth RCE
6.9.x	6.9.0 – 6.9.4	6.9.5	Full pre-auth RCE
6.8.x	6.8.0 – 6.8.5	6.8.6	SQL injection only (CVE-2026-60137)

Because the flaw is in Core and the risk is critical, the WordPress.org security team enabled forced automatic updates for sites on affected versions. That helps, but forced updates roll out gradually and can be disabled in wp-config.php, so do not wait to be pushed; pull the update yourself.

Is wp2shell being exploited right now?

Yes, and quickly. Multiple proof-of-concept exploits appeared on GitHub within hours of disclosure, some of them AI-assisted. Attack telemetry followed almost immediately: security firm watchTowr reported its honeypots logging tens of thousands of exploitation attempts from 13 distinct attacker IPs across Europe and Asia, with successful compromises underway within a day. On July 21, 2026, both CVEs were added to CISA's Known Exploited Vulnerabilities catalog, the clearest signal that this is active, not theoretical.

The post-exploitation behaviour is what matters for defenders. Attackers have created more than 100 backdoor administrator accounts, dropped a roughly 150 KB PHP web shell disguised as a security plugin named "CMSmap," harvested admin usernames and database credentials, and in some cases attempted to install a Go-based remote access trojan called Overlord RAT. In other words, patching a box that was already hit does not evict the attacker, because they left themselves a key.

Patch now: the fifteen-minute fix

For anyone running their own WordPress, the priority order is simple:

1. Update Core to 6.9.5, 7.0.2, or 6.8.6. From the dashboard it is one click; over WP-CLI it is wp core update && wp core update-db. This is the only real fix; everything below is a stopgap.
2. Block the batch endpoint if you cannot update this minute. Deny requests to /wp-json/batch/v1 and the equivalent ?rest_route=/batch/v1 at your web server or WAF. Cloudflare pushed a managed WAF rule to all plans, including free, so sites behind it get baseline coverage automatically.
3. Restrict anonymous REST access with a plugin or a small must-use filter that requires authentication on the REST API, closing the injection path.
4. Confirm the version afterward. Check Dashboard → Updates or run wp core version, so a stalled auto-update does not leave you thinking you are safe when you are not.

If you administer servers, treating Core updates as a same-day security event rather than a monthly chore is the real lesson here; our guide to the secure first hour on a new VPS covers baking that discipline in from the start. We run this site's own infrastructure through WaseerHost, our hosting company, and Core-level flaws like this are exactly why managed WordPress plans force security releases the moment they ship.

Already patched? Check whether you were hit first

This is the step most write-ups skip, and it is the one that saves you. Every security firm tracking wp2shell repeats the same warning: inspect your site for signs of compromise regardless of whether you have patched, because updating Core does nothing about a backdoor already planted. Run through this on any server that was exposed:

• Audit administrator accounts. wp user list --role=administrator should show only people you recognise. The signature of this attack is unexpected admin users, sometimes dozens of them. Delete any you did not create, and reset the passwords of the ones you keep.
• Grep your access logs. Search for hits on the batch route: grep -E "batch/v1" access.log. Requests to /wp-json/batch/v1 or ?rest_route=/batch/v1 from unfamiliar IPs, especially clustered before your patch time, are the exploitation fingerprint.
• Hunt for the web shell. Look for recently modified or oversized PHP files under wp-content/plugins and wp-content/uploads, and for a plugin you never installed (the "CMSmap" name has been observed, but assume it can be renamed). find wp-content -name '*.php' -mtime -7 is a fast first pass.
• Rotate your secrets. If there is any sign of compromise, replace the authentication keys and salts in wp-config.php, force a password reset for all users, and rotate the database credentials the attacker may have exfiltrated.

If you find a backdoor, patching is not remediation: restore from a known-good backup taken before the disclosure date, then update. A compromise this clean is closer in spirit to a supply-chain breach than a plugin bug: the trust boundary was the platform itself.

Frequently asked questions

Am I affected if my site has no extra plugins? Yes, and that is the whole point. wp2shell exploits WordPress Core, so a default install with zero plugins on an affected version (6.9.0–6.9.4 or 7.0.0–7.0.1) is vulnerable to the full remote code execution chain. Adding or removing plugins does not change your exposure to the Core flaw.

Does updating remove an attacker who already got in? No. Patching closes the door, but if someone walked through it before you patched, they may have left a backdoor administrator account or a web shell that survives the update. You have to hunt for and remove that separately, or restore from a pre-disclosure backup.

What if I can't update immediately? Block /wp-json/batch/v1 and ?rest_route=/batch/v1 at your firewall or WAF, and put the site behind a service like Cloudflare that has shipped a managed rule. These are mitigations, not fixes, so schedule the Core update as soon as you can and verify the version afterward.

Is a fully managed WordPress host safe? Largely, if the host force-pushed the Core security release, which reputable managed providers did within hours. It is still worth confirming your version and checking for rogue admin accounts, because a managed control panel does not automatically clean up a compromise that happened before the patch.

Is this related to the June 2026 patch wave? No, it is a separate WordPress Core issue, but it lands in an already ugly stretch. See our rundown of June 2026's record Patch Tuesday for the wider context on how fast critical bugs are being weaponised in 2026.

Sources

• Strobes — wp2shell: Pre-Auth RCE in WordPress Core: disclosure date and chain overview.
• Tenable — wp2shell (CVE-2026-63030, CVE-2026-60137) FAQ: CVSS scores, affected/fixed versions, and WAF mitigation.
• Rapid7 — CVE-2026-63030: wp2shell RCE in WordPress Core: exploit-chain mechanics and CISA KEV addition.
• BleepingComputer — WordPress Core "wp2shell" RCE flaws get public exploits: discoverer, forced auto-updates, and scale.
• The Hacker News — WordPress wp2shell exploitation grows: in-the-wild indicators of compromise and post-exploitation activity.