On July 17, 2026, WordPress released emergency security updates to address a critical core vulnerability dubbed "wp2shell". This flaw represents one of the most severe threats to the WordPress ecosystem in years because it allows unauthenticated remote code execution (RCE) on a stock WordPress installation with absolutely zero plugins or custom configurations active. Within 24 hours of the disclosure, on July 18, 2026, multiple functional proof-of-concept (PoC) exploits were published on GitHub, escalating the risk of active web server takeovers.

Chronology of the Vulnerability

The threat was discovered and responsibly reported through WordPress's HackerOne program by security researcher Adam Kues of Searchlight Cyber (Assetnote unit). Realizing the catastrophic potential of a core pre-auth RCE that affects a platform powering over 43% of the internet, the WordPress security team coordinated an emergency response.

On Friday, July 17, 2026, WordPress forced automatic security updates to all supported affected versions. However, because public PoC exploits were released the very next day, administrators cannot rely solely on the background update process, which can fail due to file permission blocks or disabled auto-update settings.

How the wp2shell Attack Chain Works

The "wp2shell" exploit is not a single vulnerability but a chain of two distinct security flaws: 1. CVE-2026-63030 (REST API Batch-Route Confusion): A critical vulnerability in the REST API batch request handler (`/wp-json/batch/v1`). It allows an anonymous user to bypass route restrictions and smuggle nested requests. 2. CVE-2026-60137 (SQL Injection in WP_Query): A high-severity SQL injection flaw located in the `author__not_in` (or `author_exclude`) parameter of WordPress's core `WP_Query` class, which handles post queries.

When chained together, an unauthenticated remote attacker can issue a single crafted JSON request to the REST API batch endpoint. This request uses route confusion to reach the vulnerable query and inject database payloads. From there, the attacker can extract sensitive database tables, escalate privileges, and ultimately execute arbitrary PHP code on the web hosting server.

Vulnerable Versions and Impact

The full RCE chain affects WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Additionally, WordPress versions 6.8.0 through 6.8.5 are vulnerable to the SQL injection flaw alone.

Because WordPress powers hundreds of millions of sites, the threat is categorized as Critical with a CVSS score of 9.8. If successfully exploited, an attacker gets complete access to the underlying server files and databases. In shared hosting environments, this could allow lateral movement, putting entire server networks at risk.

Urgent Protection and Remediation

To safeguard your web infrastructure, immediately take the following actions: 1. Manually Force Updates: Do not assume the background patch worked. Verify that your WordPress sites have been updated to 7.0.2, 6.9.5, or 6.8.6. 2. Scan Your Domain: Use the free checker provided by the discoverers at `wp2shell.com` to verify whether your endpoints are safe. 3. Configure Your WAF: Ensure that your Web Application Firewall (WAF) such as Cloudflare, Wordfence, or Imperva has its latest virtual patching rules active to block nested batch API queries. 4. Enable Persistent Object Caching: Enabling a persistent object cache (like Redis or Memcached) can blunt the RCE mechanism under specific configurations.