Public proof-of-concept exploits are now available for the critical “wp2shell” vulnerabilities in WordPress Core, significantly increasing the risk for websites that have not yet been updated.
Security researchers warn that attackers can chain two separate flaws together to achieve pre-authentication remote code execution, allowing malicious code to run on vulnerable WordPress sites without requiring a login.
The attack combines two vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137, affecting WordPress 6.9.x and 7.0.x. The flaws were discovered by Adam Kues of Searchlight Cyber, who said the exploit works against a default WordPress installation without requiring any plugins or special configuration. Because WordPress powers more than 500 million websites worldwide, the security issue has the potential to affect a massive number of sites.
In response to the severity of the vulnerabilities, the WordPress security team has released emergency security updates and enabled forced automatic updates for supported installations. Website owners are strongly advised to upgrade to WordPress 7.0.2 or WordPress 6.9.5 immediately to eliminate the risk.
The vulnerability is not caused by a single bug. Instead, attackers combine a REST API batch-route confusion flaw, tracked as CVE-2026-63030, with an SQL injection vulnerability in the author__not_in parameter of WP_Query, tracked as CVE-2026-60137. Together, the two flaws create a remote code execution chain affecting WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1. Although the SQL injection issue also impacts WordPress 6.8.x, it cannot be chained into remote code execution because the REST API flaw was introduced later in WordPress 6.9.
Searchlight Cyber has temporarily withheld detailed technical information to allow administrators time to secure their websites. The company has instead launched the wp2shell.com testing tool, enabling site owners to check whether their WordPress installations are vulnerable.
For organizations that cannot update immediately, temporary mitigations include blocking anonymous access to the WordPress REST API or specifically blocking requests to /wp-json/batch/v1 and ?rest_route=/batch/v1 through a web application firewall. However, researchers emphasize that these measures are only short-term protections and should not replace installing the official security updates.
Cloudflare has also rolled out Web Application Firewall protections for both vulnerabilities across all plans, including free accounts using its proxy service. The company says its rules detect and block attempts to exploit both the SQL injection and REST API vulnerabilities, while reminding customers that WAF protection reduces exposure but does not replace patching vulnerable systems.
The threat has escalated further after several proof-of-concept exploits were published on GitHub. Some demonstrations use the SQL injection flaw to retrieve WordPress password hashes before attempting to crack administrator credentials and upload a malicious plugin. Others claim to provide direct pre-authentication remote code execution without requiring administrator access, matching the original description provided by Searchlight Cyber.
Security company watchTowr has already reported seeing the first signs of attackers exploiting the vulnerabilities in real-world attacks. Researchers say serious remote code execution flaws affecting WordPress Core are relatively uncommon, making this vulnerability especially significant. With public exploit code now circulating and early exploitation already observed, administrators are strongly encouraged to update their WordPress installations to version 7.0.2 or 6.9.5 as soon as possible.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
