wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade

On Friday, July 17, 2026, the WordPress Security Team released security updates for WordPress Core addressing two vulnerabilities that, when chained together, can lead to unauthenticated remote code execution. The chain, now commonly referred to as wp2shell, was discovered and reported by Adam Kues of Assetnote / Searchlight Cyber, and we want to thank him for his work and responsible disclosure.

WordPress released patched versions 6.8.6, 6.9.5, and 7.0.2 on July 17. The WordPress release notes describe the update as addressing one critical and one high severity security issue, and state that forced automatic updates were enabled for affected versions due to the severity of the issue.

Wordfence Premium, Wordfence Care, and Wordfence Response customers received firewall protection against attacks targeting this vulnerability chain on July 17, 2026, the same day the WordPress patches were released. Wordfence Free users are scheduled to receive the same firewall protection on August 16, 2026, after the standard 30-day delay.

What Makes wp2shell So Serious

The wp2shell chain is unusual because it affects WordPress Core itself. It does not require a vulnerable plugin. It does not require a vulnerable theme. It does not require an attacker to log in. It does not require a site administrator to click a malicious link.

A vulnerable WordPress installation exposed to the public internet is enough.

At a high level, the chain combines two issues:

• CVE-2026-60137, an unauthenticated SQL injection issue involving the author__not_in query parameter.
• CVE-2026-63030, a REST API batch request route-confusion issue that can be chained with the SQL injection to reach remote code execution.

Adam Kues’ technical writeup explains how the batch API validation and execution paths could be desynchronized, allowing attacker-controlled parameters to reach a route that would normally sanitize them. From there, the SQL injection could be used in a much larger chain involving WordPress post caching, oEmbed cache rows, changesets, and action hooks. The end result is the ability to create an administrator account and then execute code through normal administrator capabilities, such as uploading a plugin.

In practical terms, successful exploitation can give an attacker full administrative control of the WordPress site and the ability to execute code with the privileges of the web server.

Who Is Affected

The affected versions differ slightly between the two vulnerabilities. According to the WordPress 7.0.2 release notes:

• WordPress 6.9.x is affected by both vulnerabilities and is patched in 6.9.5.
• WordPress 7.0.x is affected by both vulnerabilities and is patched in 7.0.2.
• WordPress 6.8.x is affected by the SQL injection vulnerability and is patched in 6.8.6.
• WordPress versions prior to 6.8 are not affected.

Because 6.8.x is not affected by the REST API batch route-confusion issue, it is not exposed to the full remote code execution chain — but it should still be updated promptly to address the SQL injection.

If your site is running WordPress 6.8.x, 6.9.x, or 7.0.x, you should confirm immediately that it has updated to the appropriate patched version.

Timeline: Disclosure, Protection, and Exploitation

Here is the timeline from official disclosure:

This means exploitation activity began very quickly. Sites that did not update promptly were exposed while public technical details were circulating and attackers were already probing for vulnerable installations.

What We Saw in Attack Data

After reviewing attack data associated with our wp2shell firewall rule, we found that attackers were not merely scanning for the existence of the /wp-json/batch/v1 endpoint. We observed requests attempting to exercise the batch route confusion behavior and, shortly afterward, requests attempting SQL injection. We later confirmed through our own testing that the SQL injection is central to the full RCE chain.

What Wordfence Customers Should Know

Wordfence Premium, Wordfence Care, and Wordfence Response customers received firewall protection on July 17, 2026.

However, a firewall rule is not a replacement for patching WordPress Core. Firewall protection helps reduce exploitability, but the correct long-term remediation is to update to a fixed WordPress version.

What Site Owners Should Do Now

If you manage a WordPress site, take the following steps immediately:

Because the impact can include administrator creation and code execution, any suspected exploitation should be treated as a potential full site compromise.

Conclusion

wp2shell is one of the most significant WordPress Core security events in recent years. The combination of unauthenticated reachability, no plugin or theme requirement, a large global attack surface, a path to administrator access and code execution, as well as public proof-of-concept exploit availability makes this vulnerability chain unusually serious.

The WordPress Security Team moved quickly to release patched versions, and Wordfence Premium, Care, and Response customers received firewall protection on the day of disclosure. But public exploit activity began within hours, and patching remains the most important step site owners can take.

If you have not already confirmed that your site is running a patched WordPress version, do that now.