The WordPress project has issued an emergency security update to patch a critical chain of vulnerabilities, identified as wp2shell, that allows unauthenticated attackers to execute arbitrary code on vulnerable websites. This flaw, which carries a CVSS score of 9.8, affects WordPress versions 6.9 through 7.0.1 and has already prompted warnings of circulating proof-of-concept (PoC) exploits and early indications of real-world exploitation. As WordPress powers an estimated 500 million websites globally, this vulnerability is particularly significant because it can be exploited against a default installation with no plugins or special preconditions, making it a direct threat to the core platform itself.
Understanding the wp2shell Vulnerability Chain
The wp2shell chain was discovered by Adam Kues of Searchlight Cyber and responsibly disclosed to the WordPress Security Team. The issue consists of two distinct vulnerabilities addressed in the July 17 security release. The first, tracked as CVE-2026-60137, is a high-severity unauthenticated SQL injection flaw. This vulnerability, by itself, is a serious concern for database integrity. However, its true danger is realized when it is chained with a second flaw, CVE-2026-63030, a critical REST API batch-route confusion vulnerability that converts the SQL injection into a full remote code execution (RCE) attack.
How the REST API Exploit Allows Remote Code Execution
Security researchers from Wordfence have detailed that the RCE originates from the /wp-json/batch/v1codecodecodecodecodecode REST API endpoint. The core issue is a desynchronization between route validation and dispatch. This flaw allows attacker-controlled requests to bypass intended security restrictions. By exploiting this route confusion, an attacker can leverage the initial SQL injection to execute malicious code on the server, effectively taking control of the website.
Patched Versions and Immediate Mitigations
The patched releases are WordPress 7.0.2, 6.9.5, and 6.8.6. It is important to note that the 6.8 branch is only affected by the SQL injection vulnerability and not the full RCE chain. Due to the severity of the issues, the WordPress project has enabled automatic security updates for supported vulnerable installations. For organizations unable to apply the patch immediately, a temporary mitigation plugin is available from Searchlight Cyber. This plugin requires authentication before processing batch API requests. As a supplementary measure, administrators can also block anonymous access to the REST API batch endpoint by restricting requests to /wp-json/batch/v1codecodecodecodecodecode and the rest_route=/batch/v1codecodecodecodecodecode parameter at the web application firewall level. It is critical to understand that these workarounds may impact legitimate functionality and should only be used as a stopgap until the official update is applied.
What Makes This WordPress Core Vulnerability Unusual
Benjamin Harris, CEO of watchTowr, noted that unauthenticated SQL injection and remote code execution vulnerabilities in the core of a mature CMS like WordPress are relatively uncommon. This rarity makes the disclosure particularly concerning. The security community is already observing PoC exploits in circulation and the first signs of in-the-wild exploitation, indicating how rapidly attackers are moving to weaponize this vulnerability chain against a vast pool of potential targets.
What Affected Users Should Do Now
The urgency of this situation cannot be overstated. Every WordPress site administrator must immediately update to the latest patched version: WordPress 7.0.2, 6.9.5, or 6.8.6. Verify that automatic updates have completed successfully on your dashboard. If patching was delayed, it is imperative to review your server for signs of compromise, such as newly deployed backdoors or unexpected files. As a general security practice, always deploy a multi-layered endpoint protection solution with real-time threat detection and behavioral analysis on your server. Furthermore, ensure all administrative accounts use strong, unique passwords and that two-factor authentication is enabled. Switching to a reputable, no-log VPN service when managing your site from public networks is also a recommended step to protect your administrative credentials from interception. These actions are not optional; they are a direct response to a critical, actively exploited threat against the world’s most popular content management system.
