Wordpress has released an emergency security update that fixes a critical vulnerability chain known as wp2shell. The security issue allows a remote attacker to compromise certain WordPress installations without knowing a password, without having a user account, and even without any vulnerable plugin or theme being installed.
The issue primarily affects websites running WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The vulnerability has been fixed in versions 6.9.5 and 7.0.2. Due to the severity of the incident, WordPress has also enabled forced automatic security updates. Website administrators should nevertheless verify that the update was installed successfully.
Official WordPress security update announcement
What Is wp2shell?
The name wp2shell refers to a chain of two security vulnerabilities in the WordPress core:
- CVE-2026-63030 – a handler confusion vulnerability in the WordPress REST API batch interface,
- CVE-2026-60137 – an SQL injection vulnerability in the
author__not_inparameter used by theWP_Queryclass.
Individually, the vulnerabilities have different impacts. When combined, however, they may allow remote code execution, also known as an RCE attack, on vulnerable WordPress versions.
WordPress project security advisory
In a worst-case scenario, this means that an attacker could gain control of the website, access the database, modify content, create administrator accounts, install malicious code, or use the compromised server to launch further attacks.
Why Is This Vulnerability So Dangerous?
Most successful attacks against WordPress websites are associated with outdated plugins, unsupported themes, or weak passwords. In this case, however, the vulnerability is located directly in the WordPress core.
According to researchers at Searchlight Cyber, the attack can be carried out anonymously against a standard WordPress installation that does not use any plugins. The attacker does not require prior access, an administrator account, or any special configuration on the target website.
Technical analysis of wp2shell by Searchlight Cyber
The fact that no authentication is required significantly increases the risk of automated exploitation. Once technical details or functional proof-of-concept tools become publicly available, attackers may begin scanning the internet for vulnerable websites on a large scale.
How Does the Attack Work?
The vulnerability begins in the WordPress REST API batch endpoint:
/wp-json/batch/v1This interface allows multiple REST API requests to be combined into a single HTTP request. WordPress must validate each embedded request and then pass it to the correct handler.
A vulnerability described as batch-route confusion may, under certain circumstances, cause validation results and corresponding routes to become incorrectly associated. As a result, a request may be processed by a different part of WordPress than the one for which it was originally validated.
This may expose the vulnerable database parameter author__not_in. The resulting SQL injection may allow unauthorized access to data and, when combined with other WordPress functions, may ultimately lead to the execution of attacker-controlled code.
Security notice: For security reasons, this article does not include the exploit itself or detailed instructions for using it.
Which WordPress Versions Are Vulnerable?
Critical Vulnerability Chain Leading to RCE
| WordPress Version | Status |
|---|---|
| 6.9.0–6.9.4 | Vulnerable |
| 6.9.5 | Fixed |
| 7.0.0–7.0.1 | Vulnerable |
| 7.0.2 | Fixed |
WordPress versions earlier than 6.9 are not vulnerable to the complete wp2shell chain that leads to remote code execution. However, versions 6.8.0 through 6.8.5 contain the separate SQL injection vulnerability CVE-2026-60137, which was fixed in version 6.8.6.
Administrators should therefore use at least:
- WordPress 7.0.2 or later,
- WordPress 6.9.5 or later within the 6.9 branch,
- WordPress 6.8.6 or later within the 6.8 branch.
What Website Administrators Must Do
1. Verify the Current Version
You can check the installed version in the WordPress administration area under Dashboard → Updates.
If you use WP-CLI, run:
wp core versionThis command displays the currently installed WordPress core version.
Documentation for the wp core version command
2. Install the Security Update
Before performing a manual update, create a backup of both the website files and the database. WordPress recommends updating through the administration interface by selecting Update Now.
Official WordPress update guide
If you use WP-CLI, run:
wp core updateBy default, WP-CLI updates WordPress to the latest available version.
Documentation for the wp core update command
Do not simply assume that the hosting provider or the automatic update mechanism has installed the update. Automatic updates may fail because of file permissions, disabled update settings, or non-standard server configurations.
3. Temporarily Block the REST API Batch Endpoint
If the update cannot be installed immediately, researchers recommend temporarily restricting anonymous access to the following paths:
/wp-json/batch/v1
?rest_route=/batch/v1The paths can be blocked using a web application firewall, reverse Proxy, or web server configuration.
Important: This is only a temporary emergency measure. Restricting the REST API may disrupt plugins, editors, or external integrations and must not be considered a replacement for installing the patched version.
How to Check Whether the Website Has Been Compromised
After updating, administrators should perform at least a basic integrity check of the WordPress installation.
Check WordPress Core Files
wp core verify-checksumsThis command compares WordPress core files against the official checksums from WordPress.org. Modified or unexpected files may indicate a manual change, a failed update, or a compromised website.
Documentation for the wp core verify-checksums command
Check Administrator Accounts
wp user list --role=administratorCheck whether the list contains unknown accounts, suspicious email addresses, or administrators created at an unusual time. WP-CLI can display usernames, email addresses, registration dates, and assigned roles.
Documentation for the wp user list command
Check Installed Plugins
wp plugin listPay particular attention to recently installed, unknown, or unusually named plugins. The command lists installed plugins, their status, and available updates.
Documentation for the wp plugin list command
Administrators should also review:
- web server and WAF access logs,
- requests sent to the REST API batch endpoint,
- recently modified PHP files,
- the contents of the
wp-content/uploadsdirectory, - unknown scheduled tasks and cron jobs,
- changes to the
wp-config.phpfile, - unusual outbound network connections,
- new redirects, injected advertising content, or unexpected changes in search engine results.
Finding a suspicious request does not necessarily prove that an attack was successful. If there is a reasonable suspicion of compromise, the website should be isolated, available logs should be preserved, and the incident should be investigated by an experienced security specialist.
The Update Is Necessary Even for Websites Without Plugins
Wp2shell demonstrates why WordPress security cannot be based solely on updating plugins and themes. In this case, the vulnerability is located directly in the WordPress core and may affect even an almost clean installation.
Most important action: Update WordPress to a patched version immediately and then verify the integrity of the installation.
WordPress released the security update on 17 July 2026 and, due to the severity of the issue, enabled forced automatic updates for affected installations. This step is a clear indication that delaying the update represents an unacceptable risk.