A serious WordPress core vulnerability known as WP2Shell has prompted an urgent response from the WordPress project. By chaining two separate flaws, unauthenticated attackers may gain remote code execution and take over affected websites without plugins, themes or login credentials. Site owners should verify their versions and updates immediately.
Key takeaways
- WP2Shell combines CVE-2026-63030 and CVE-2026-60137.
- Affected versions include WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1.
- WordPress released fixes in versions 6.9.5 and 7.0.2.
- Forced updates were issued for sites with automatic updates enabled.
- Unrecognised administrator accounts may indicate attempted compromise.
WP2Shell is particularly concerning because it affects WordPress core rather than a single plugin or theme. That gives the vulnerability a potentially broad reach across internet-facing websites, including otherwise well-maintained sites with minimal third-party software.
How the vulnerability works
The attack combines a REST API batch-route confusion flaw with a separate SQL injection issue. Individually, neither bug provides full system control. Together, however, they can allow an anonymous request to bypass expected checks, manipulate database activity and create an administrator account.
Once administrator access is obtained, an attacker can install malicious plugins or upload webshells. Security researchers say the chain can lead to full site takeover and remote code execution. Reports from Bitdefender indicate active exploitation, while other research has warned that public proof-of-concept code could accelerate attacks.
WordPress response and affected versions
WordPress addressed the chain in 6.9.5 and 7.0.2. The project also pushed forced updates to installations where automatic updates were enabled. However, site owners should not assume that an update was successful: hosting controls, management tools and customised update settings can prevent automatic patching.
| WordPress version | Status |
|---|---|
| 6.9.0–6.9.4 | Update urgently |
| 7.0.0–7.0.1 | Update urgently |
| 6.9.5 and later | Fixed |
| 7.0.2 and later | Fixed |
The related SQL injection vulnerability, CVE-2026-60137, was also backported to an earlier supported branch in the same security response.
What website owners should do
First, check the WordPress version on every public-facing site and update to a fixed release. If an immediate update is impossible, temporarily restrict anonymous access to the REST API batch endpoint through a web application firewall or hosting provider. This is only a short-term measure, not a replacement for patching.
After updating, review administrator accounts, installed plugins and recently modified PHP files. Unexpected accounts, unfamiliar plugins or unusual files under wp-content deserve urgent investigation. Access logs showing unusual requests to the batch endpoint, especially those returning HTTP 207 responses, may also be useful evidence.
Why a WordPress care plan matters
WP2Shell is a reminder that WordPress maintenance involves more than occasionally clicking an update button. A dependable WordPress maintenance plan should track versions, apply security releases, check that updates completed successfully and provide backups and monitoring if a site is targeted.
For businesses without an in-house technical team, a WordPress care plan can reduce the time between a security release and verified protection. It also provides a practical route to investigate suspicious accounts or files before a minor incident becomes a full website takeover.
Sources
- Symbiotic Security Breaks Down WP2Shell, a WordPress Core RCE Chain SAST Misses – Technology Today, EIN News.
- wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins – Latest Hacking News, Latest Hacking News – Exploits, Vulnerabilities, Tech and Tutorials.
- wp2shell — Unauthenticated Remote Code Execution and Full Site Takeover in WordPress Core, Bitdefender.
- [wp2shell — Unauthenticated Remote Code Execution and Full Site Takeover in WordPress Core
- Security Boulevard](https://securityboulevard.com/2026/07/technical-advisory-wp2shell-unauthenticated-remote-code-execution-and-full-site-takeover-in-wordpress-core/), Security Boulevard.