WordPress Core “wp2shell” RCE flaws get public exploits, patch now

The cybersecurity landscape has been shaken by the emergence of "wp2shell," a series of critical remote code execution (RCE) vulnerabilities in WordPress Core that demand immediate attention from website administrators globally. Public exploits for these flaws have been released, dramatically increasing the risk of widespread compromise, and reports indicate that in-the-wild exploitation has already begun. The vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137, can be chained together to achieve pre-authentication remote code execution against WordPress installations running versions 6.9.x and 7.0.x, making prompt patching to WordPress 7.0.2 or 6.9.5 an absolute imperative.

Understanding the "wp2shell" Threat

Discovered by Adam Kues of Searchlight Cyber, the "wp2shell" attack is a sophisticated chain of two distinct, yet combinable, vulnerabilities. What makes this threat particularly severe is its "pre-authentication" nature, meaning an attacker does not need to log in or possess any prior credentials to exploit it. Furthermore, Searchlight Cyber emphasized that the attack has "no preconditions" and can be executed by an anonymous user against a "stock install of WordPress with no plugins," highlighting its broad applicability and ease of exploitation.

The first vulnerability in the chain, CVE-2026-63030, is identified as a REST API batch-route confusion flaw. This issue was introduced in WordPress 6.9 and, when combined with the second vulnerability, facilitates remote code execution. The WordPress REST API is a powerful interface that allows external applications and services to interact with WordPress, making vulnerabilities within it highly impactful. Batch-route confusion exploits often involve tricking the system into processing requests in an unintended way, bypassing security controls.

The second crucial component is CVE-2026-60137, an SQL injection vulnerability found in the ‘author__not_in‘ parameter of ‘WP_Query‘. SQL injection flaws allow attackers to interfere with the queries an application makes to its database. By injecting malicious SQL code, attackers can gain access to sensitive data, modify database contents, or, as in this case, potentially escalate their privileges to execute arbitrary code. WordPress describes this as a high-severity SQL injection affecting versions 6.8 and later.

While the SQL injection vulnerability (CVE-2026-60137) affects a broader range of versions, from WordPress 6.8.0 through 6.8.5, it cannot be leveraged for the full remote code execution chain in these earlier versions. This is because the REST API batch-route confusion bug (CVE-2026-63030) was only introduced in WordPress 6.9. Consequently, the complete "wp2shell" RCE chain specifically targets WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1. The necessary fixes for the full attack chain have been implemented in WordPress 6.9.5 and 7.0.2.

A Rapidly Unfolding Timeline of Disclosure and Response

The discovery of the "wp2shell" vulnerabilities initiated a swift, albeit challenging, response from the cybersecurity community and WordPress developers.

• Discovery: Adam Kues of Searchlight Cyber identified the two critical flaws, understanding their potential for a pre-authentication RCE chain. Searchlight Cyber initially opted to withhold detailed technical specifics of the exploit, a common practice known as responsible disclosure, to provide administrators with a crucial window to patch their systems before widespread exploitation could occur. To aid administrators, they launched the wp2shell.com website, offering a tool for site owners to check their WordPress installations for vulnerability.
• Official Patch Release: Recognizing the severity, the WordPress security team acted decisively. They issued security announcements urging immediate updates to WordPress 7.0.2 or 6.9.5. Crucially, due to the high risk posed by "wp2shell," WordPress enabled forced automatic security updates for supported installations running affected versions. This proactive measure aims to rapidly secure a significant portion of the vulnerable ecosystem.
• Emergence of Public Exploits: Despite Searchlight Cyber’s initial restraint, the nature of such critical vulnerabilities often leads to independent rediscovery and public disclosure. Soon after the patches were released, multiple proof-of-concept (PoC) exploits began appearing on GitHub. These PoCs varied in their approach; some demonstrated how to combine the vulnerabilities to extract WordPress password hashes via SQL injection, then crack an administrator password to upload a malicious plugin and execute commands. More alarmingly, other PoC exploits claimed to achieve pre-authentication remote code execution without requiring any administrator credentials, aligning more closely with Searchlight Cyber’s initial description of the flaws.
• Proactive Protections: Cloudflare, a widely used web infrastructure and security company, quickly responded by deploying Web Application Firewall (WAF) protections. These rules, implemented across all Cloudflare plans, including free accounts, target attempts to exploit both CVE-2026-60137 and CVE-2026-63030. While offering a crucial layer of defense, Cloudflare reiterated that WAF protections are a temporary measure and not a substitute for applying the official WordPress patches.
• In-the-Wild Exploitation: The most concerning development following the public release of PoCs was the confirmation of active exploitation. Security firm watchTowr reported observing "in-the-wild exploitation" shortly after the public exploits became available. This confirms that malicious actors are already leveraging the vulnerabilities, transforming the theoretical threat into an immediate, tangible danger for unpatched sites.

The Enormous Scale of Impact: WordPress’s Global Dominance

The "wp2shell" vulnerability carries an unprecedented potential for widespread damage due to WordPress’s unparalleled global market share. Searchlight Cyber’s estimate of "more than 500 million websites" using WordPress, while significant, might even be conservative. Industry statistics consistently show that WordPress powers approximately 43% of all websites on the internet, which translates to hundreds of millions of active sites. This makes it the most dominant content management system (CMS) by a vast margin.

This immense footprint means that a critical, pre-authentication RCE vulnerability in WordPress Core is akin to a flaw in the foundational infrastructure of a significant portion of the internet. Attackers are constantly scanning for vulnerabilities in popular platforms, knowing that a single exploit can yield access to millions of potential targets. The ease of exploitation, requiring no prior authentication or complex setup, further amplifies this risk. Compromised WordPress sites can be leveraged for a multitude of malicious activities:

• Website Defacement: Changing the appearance of a website to display political messages, advertisements, or offensive content.
• Data Theft: Stealing sensitive user data, including personal information, login credentials, and financial details from e-commerce sites.
• Malware Distribution: Injecting malicious code into websites, turning them into platforms for distributing malware, ransomware, or phishing scams to visitors.
• SEO Spam: Manipulating search engine rankings by injecting spam links or content, damaging the site’s reputation and SEO efforts.
• Botnet Recruitment: Enlisting compromised servers into botnets for distributed denial-of-service (DDoS) attacks, cryptocurrency mining, or other large-scale illicit operations.

The sheer volume of potential targets, coupled with the critical nature of the RCE, positions "wp2shell" as one of the most significant WordPress vulnerabilities in recent memory.

Official Guidance and Mitigation Strategies

The response from official channels has been clear and urgent: update immediately.

• WordPress Core Team: The official recommendation from WordPress is unequivocal: "Because this is a security release, it is recommended that you update your sites immediately." The decision to enable forced automatic updates for affected versions underscores the extreme severity and the need for rapid deployment of patches. This mechanism ensures that many sites, especially those configured for auto-updates, receive the necessary fixes without manual intervention. However, administrators should still verify that their sites have successfully updated.
• Searchlight Cyber’s Recommendations: While Searchlight Cyber initially withheld technical details to buy time for patching, they provided temporary mitigation advice for organizations unable to update immediately. These include:
  • Implementing a Web Application Firewall (WAF) to filter malicious traffic.
  • Applying rate limiting to the REST API endpoints to prevent brute-force or rapid exploitation attempts.
  • Blocking suspicious IP addresses identified as scanning or attempting to exploit the vulnerability.
    It is critical to understand that these are temporary measures designed to reduce exposure and are "not a substitute for patching," as Searchlight Cyber explicitly stated.
• Cloudflare’s Proactive Defense: Cloudflare’s swift deployment of WAF rules provides an important frontline defense for millions of websites. Their rules specifically target the exploitation attempts of both CVE-2026-60137 and CVE-2026-63030. This layered defense is invaluable, especially for site owners who might not be able to patch instantly, but it reinforces the message that WAFs are a risk reduction strategy, not a complete solution.

The Broader Implications for Web Security

The "wp2shell" vulnerability serves as a stark reminder of the persistent challenges in securing the internet’s most popular platforms. While WordPress often receives criticism regarding security, core RCE vulnerabilities are relatively rare and highlight a deeper, more systemic issue in software development and maintenance. As watchTowr CEO Benjamin Harris noted, "WordPress gets a bad rap for security. But the reality is that a highly impactful, unauthenticated SQL injection or remote code execution vulnerability in WordPress core is actually fairly rare." This rarity is precisely what makes "wp2shell" so concerning and why security teams worldwide are scrambling to respond.

The rapid transition from vulnerability disclosure to public exploit availability and, ultimately, to in-the-wild exploitation underscores the speed at which cyber threats evolve. Attackers are constantly monitoring security advisories and code repositories for new opportunities. The moment a PoC exploit is published, even if incomplete or flawed, it lowers the barrier to entry for a wider range of malicious actors, from script kiddies to sophisticated threat groups.

This incident also highlights the collaborative nature of cybersecurity. The vulnerability was discovered by an independent security researcher, responsibly disclosed, patched by the core development team, and further protected by third-party security vendors like Cloudflare. This ecosystem of researchers, developers, and security providers is essential for maintaining the integrity of widely used software. However, the ultimate responsibility for applying patches lies with individual site owners and administrators.

Best Practices for Long-Term WordPress Security

Beyond immediate patching, the "wp2shell" incident reinforces the need for robust, ongoing security practices for all WordPress users:

• Regular Updates: Make a habit of regularly updating WordPress Core, themes, and plugins. Enable automatic updates for minor releases and security patches where possible, but always monitor the process.
• Strong Authentication: Use strong, unique passwords for all WordPress accounts. Implement two-factor authentication (2FA) for enhanced security.
• Principle of Least Privilege: Grant users only the minimum necessary permissions. Limit the number of administrator accounts.
• Security Plugins: Utilize reputable WordPress security plugins that offer features like firewall protection, malware scanning, login hardening, and activity logging.
• Regular Backups: Implement a robust backup strategy. Ensure that full site backups (files and database) are performed regularly and stored securely off-site. This allows for quick recovery in case of a compromise.
• Web Application Firewall (WAF): Deploy a WAF at the server level or via a service like Cloudflare to provide an additional layer of defense against common web exploits.
• Secure Hosting: Choose a reputable hosting provider that offers security features such as malware scanning, DDoS protection, and server-level firewalls.
• Monitor Activity: Regularly monitor website logs for suspicious activity, failed login attempts, or unauthorized file changes.
• Stay Informed: Subscribe to official WordPress security announcements and reputable cybersecurity news sources to stay abreast of emerging threats.

In conclusion, the "wp2shell" vulnerabilities represent a significant threat to the vast WordPress ecosystem. The combination of critical pre-authentication remote code execution, the widespread adoption of WordPress, and the confirmed in-the-wild exploitation necessitates an immediate and decisive response from all administrators. Patching to WordPress 7.0.2 or 6.9.5 is not merely a recommendation but a critical security mandate to protect websites from potential compromise and safeguard the integrity of the internet’s most popular publishing platform.