A WordPress site doesn't need a single plugin installed to get hacked right now.
A newly disclosed vulnerability called wp2shell has changed the threat model for over 500 million WordPress websites. No login. No plugin. No user interaction. Just one crafted request to WordPress Core, and an attacker can walk away with admin access and full remote code execution.
What happened
On July 17, 2026, the WordPress security team shipped emergency releases — versions 7.0.2, 6.9.5, and 6.8.6 — to close a critical vulnerability chain. The bug lives in WordPress Core itself, not a third-party plugin or theme, which means the attack surface isn't determined by what extensions you've installed.
The technical chain
wp2shell is actually two chained CVEs:
| CVE | Type | Description |
|---|---|---|
| CVE-2026-60137 | SQL Injection | Unauthenticated SQL injection in the author__not_in parameter of WP_Query. Present since WordPress 6.8. |
| CVE-2026-63030 | REST API Route Confusion | A batch-route confusion bug in /wp-json/batch/v1 that lets unauthenticated requests reach functionality normally gated behind login. Affects 6.9+. |
The route confusion bug bypasses the auth check protecting the SQL injection, letting an attacker query the database directly — including tables holding admin password hashes. From there, cracking the hash and logging in as admin opens the door to a webshell via standard theme/plugin editor functionality.
Affected versions
- 6.8.x — SQL injection only, fixed in 6.8.6
- 6.9.0–6.9.4 — full RCE chain, fixed in 6.9.5
- 7.0.0–7.0.1 — full RCE chain, fixed in 7.0.2
WordPress force-pushed this update via auto-update to affected sites — a step it rarely takes.
Why this matters for devs specifically
If you build on top of WordPress (custom plugins, headless setups, REST API integrations), this is a good moment to review how your own endpoints handle the batch API and authentication checks, not just wait on core patches.
Full breakdown
I wrote a complete technical walkthrough covering indicators of compromise, WAF mitigation rules, WP-CLI patch verification commands, and credential rotation steps here:
👉 Full wp2shell breakdown, IOCs, and patch guide
Has anyone here already checked their WordPress installs, or seen this being probed for in the wild?
Top comments (0)