WordPress Core Suffers Critical Pre-Authentication Remote Code Execution Vulnerability

An anonymous HTTP request can now execute arbitrary code on a WordPress site due to a critical vulnerability present in the platform’s core. This exploit, dubbed "wp2shell," affects a significant portion of WordPress installations and was only mitigated by the recent release of patched versions. The bug is deeply embedded in the core codebase, meaning even a clean installation without any plugins is susceptible. Prior to the release of WordPress versions 6.9.5 and 7.0.2, all sites running versions 6.9 and 7.0 were potentially exposed. These latest releases, shipped on Friday, July 17, 2026, include what WordPress terms "forced updates" via its auto-update system, aiming to rapidly patch affected installations.

The wp2shell vulnerability is not a single flaw but a chain of two distinct security issues. The first, identified as CVE-2026-63030, involves a confusion within the REST API’s batch routing mechanism. The second, CVE-2026-60137, is a SQL injection vulnerability found directly within WordPress core. When exploited in tandem, these two vulnerabilities allow an unauthenticated attacker to gain complete control over a WordPress website through a single, anonymous HTTP request.

The full technical details of this exploit chain were published shortly after the patched versions were released, and a working proof-of-concept (PoC) exploit is now publicly available on GitHub, dramatically increasing the urgency for site administrators to update.

Discovery and Disclosure Timeline

The initial discovery of the batch-route confusion vulnerability was made by Adam Kues, operating under Assetnote, the attack surface management division of Searchlight Cyber. Kues responsibly reported this finding through WordPress’s established HackerOne bug bounty program. The subsequent SQL injection vulnerability was independently reported by multiple researchers: TF1T, dtro, and haongo.

Searchlight Cyber published a detailed write-up of their findings under the name "wp2shell," emphasizing that the exploit "has no preconditions and can be exploited by an anonymous user." This highlights the severity of the vulnerability, as it requires no prior access or authentication to trigger. While Searchlight Cyber has held back its own in-depth technical analysis, the public availability of the patch and the shared proof-of-concept means that the technical mechanism is now accessible to the wider security community, including malicious actors.

The WordPress Security Team, in collaboration with the researchers, worked swiftly to address these critical issues. The patches were incorporated into WordPress versions 6.9.5 and 7.0.2, released on Friday, July 17, 2026. The forced update mechanism, a feature designed to push critical security updates to sites that may not have auto-updates enabled, was activated to expedite the patching process across the vast WordPress ecosystem.

Technical Breakdown of the Vulnerabilities

The wp2shell exploit chain leverages two distinct but complementary vulnerabilities. The SQL injection (CVE-2026-60137) is rooted in the WP_Query class, specifically within the author__not_in parameter. Attackers can exploit this by providing a string value instead of the expected array. This bypasses crucial validation checks, allowing raw, unescaped input to be directly injected into the SQL query. This injection, on its own, can lead to significant data exfiltration and manipulation within the WordPress database.

However, the true power of the wp2shell exploit lies in its ability to reach this vulnerable parameter without authentication, which is achieved through the REST API batch endpoint (CVE-2026-63030). Introduced in WordPress 5.6 in 2020, the batch endpoint allows multiple REST API sub-requests to be processed in a single HTTP call. It manages these requests using two parallel arrays. A flaw in how the endpoint handles errors in one sub-request can cause these arrays to become desynchronized. This desynchronization allows a maliciously crafted request to execute a subsequent sub-request under the handler of a different, potentially less secure, request.

By chaining these two vulnerabilities, an attacker can send an anonymous HTTP request to the batch endpoint. The batch endpoint’s routing confusion leads to the attacker’s input being directed to the vulnerable author__not_in parameter of WP_Query, bypassing authentication and authorization checks. This effectively transforms a SQL injection vulnerability into a pre-authentication remote code execution (RCE) flaw.

Scope of Exposure

The impact of wp2shell is significant due to the widespread adoption of WordPress. According to Searchlight Cyber’s estimates, over 500 million websites utilize the WordPress platform. However, the RCE chain specifically requires versions 6.9 or higher. WordPress version 6.9 was released on December 2, 2025, meaning that any site exposed to the full code-execution path was running a relatively recent version, released within the last eight months. The exact number of sites running versions 6.9 and 7.0 prior to the patches remains unknown, but it represents a substantial portion of the active WordPress user base.

The SQL injection vulnerability, CVE-2026-60137, has a wider reach, dating back to WordPress version 6.8. This means that older sites, while not susceptible to the full RCE chain, are still vulnerable to data breaches and manipulation through the SQL injection alone. WordPress 6.8.6 specifically addresses the SQL injection in versions prior to 6.9.

Nuances in Vulnerability Scoring and Impact

The severity of these vulnerabilities has been reflected in their assigned scores and advisories, though with some notable discrepancies. WordPress’s own security advisory rates the complete RCE chain as "Critical." However, the Common Vulnerabilities and Exposures (CVE) record for the combined exploit scores a 7.5, classifying it as "High." The impact metrics listed for this CVE primarily focus on data access, potentially understating the full implications of remote code execution, which includes integrity and availability loss.

The SQL injection vulnerability, CVE-2026-60137, is scored even higher, with a CVSS score exceeding 9.1, also classifying it as "Critical." This scoring emphasizes the direct and severe impact of the SQL injection on database integrity. Security experts advise tracking both CVEs individually rather than relying solely on the "Critical RCE" label, as the injection vulnerability represents a significant threat on its own.

Persistent Object Cache Condition and Blast Radius

A crucial factor that narrows the direct RCE attack vector’s blast radius is the presence of a persistent object cache. According to analysis by Cloudflare, which has released Web Application Firewall (WAF) rules to mitigate the exploit, the code-execution path specifically fails when a site is actively utilizing a persistent object cache, such as Redis or Memcached. A default WordPress installation, which does not typically include such caching mechanisms, remains fully exposed to the RCE chain.

While the absence of a persistent object cache is a precondition for the RCE, it is not a fix. Sites that are not using these caching solutions remain vulnerable to the full exploit. Furthermore, the SQL injection vulnerability remains a threat irrespective of object caching configurations. Therefore, while object caching might offer some protection against the RCE aspect, it does not fully remediate the security risks posed by wp2shell.

Mitigation and Remediation Efforts

The primary and most effective mitigation for the wp2shell vulnerability is to update WordPress to the latest patched versions, 6.9.5 or 7.0.2. WordPress’s forced auto-update system is designed to push these critical patches to a vast majority of sites. However, administrators are strongly advised to verify their WordPress version directly rather than relying solely on the assumption that the update has been applied. Some sites may have explicitly disabled auto-updates, or the forced update mechanism may not have reached them yet.

For organizations that cannot immediately update their WordPress installations, several interim mitigation strategies have been proposed. These generally focus on preventing anonymous access to the batch endpoint. However, these are considered stopgap measures and may interfere with legitimate website functionalities and integrations. Recommended temporary measures include:

• Web Application Firewall (WAF) Rules: Implementing WAF rules that block requests to the /wp-json/batch/v1 endpoint from unauthenticated users. Cloudflare has provided specific rules for this purpose.
• Server-Level Access Control: Configuring server access controls (e.g., via .htaccess or Nginx configuration) to deny access to the batch endpoint for anonymous visitors.
• Plugin-Based Restrictions: Utilizing security plugins that offer features to restrict access to specific REST API endpoints.

These measures are not foolproof and can introduce compatibility issues with legitimate plugins or custom integrations that rely on the batch endpoint. The underlying vulnerabilities remain unpatched until the core WordPress software is updated.

Broader Implications and Industry Response

The wp2shell vulnerability underscores the persistent challenges in securing the massive WordPress ecosystem. With an estimated 43% of all websites powered by WordPress, any core vulnerability can have a far-reaching impact. The speed at which the exploit mechanism was published and a proof-of-concept developed after the patch release highlights the constant race between security researchers and malicious actors in the open-source world.

The vulnerability’s public disclosure and the availability of an exploit on GitHub mean that mass exploitation is not only possible but highly probable. The history of WordPress security incidents shows a pattern of mass exploitation occurring even for vulnerabilities that require non-default configurations or are already patched. This vulnerability, being present in core and affecting default installations, presents a particularly attractive target.

As of July 18, 2026, the vulnerability was not yet listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog, which typically requires confirmed exploitation in the wild. No exploitation attempts had been publicly reported at that time. However, this lack of immediate public exploitation should not be interpreted as a sign of reduced risk. Security scanners, such as Rapid7’s InsightVM and Nexpose, are expected to include authenticated checks for the vulnerability by July 20, 2026, enabling organizations to better identify their exposure.

The disclosure of wp2shell also brings to light the complexities of vulnerability scoring and communication. While WordPress’s advisory labels the RCE as "Critical," the CVE score and its impact metrics are more nuanced. This highlights the importance for security professionals to delve beyond simplified labels and understand the specific technical details and scoring of each vulnerability.

The WordPress Security Team’s decision to implement forced updates for versions 6.9.5 and 7.0.2 demonstrates a proactive and aggressive approach to mitigating widespread threats. This move, while potentially disruptive for some users, prioritizes the security of the vast majority of the WordPress user base. The effectiveness of this strategy will be evident in the coming weeks as WordPress tracks the adoption rate of the patched versions against the anticipated rise in attack attempts targeting the batch endpoint. The outcome will likely be determined by which curve is steeper: the adoption of security patches or the volume of malicious activity.