WordPress is racing to contain a severe security lapse in its core platform, pushing out emergency fixes for a remote code execution flaw that can be triggered without authentication. The vulnerability, which allows a single HTTP request to compromise a default installation, lets an anonymous attacker gain full control of a site’s underlying environment.
Cataloged as CVE-2026-63030 and known as “wp2shell,” the exploit chains together a REST API batch route confusion bug with a SQL injection weakness to deliver unauthenticated code execution. Security researchers say this combination effectively hands over the keys to affected sites, with no need for user credentials, special configuration, or additional plugins.
On July 17, 2026, the project shipped WordPress versions 7.0.2 and 6.9.5 to neutralize the wp2shell attack chain. A related SQL injection issue, tracked as CVE-2026-60137, is fixed separately in WordPress 6.8.6. The complete RCE path impacts WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, while versions earlier than 6.8 are not impacted by either of the disclosed bugs.
Security vendors analyzing the flaw report that the RCE becomes exploitable when a persistent object cache is not enabled, a situation that aligns with the configuration of most typical WordPress installations. In other words, many sites are likely exposed unless they have already adopted the latest releases or operate with less common caching setups.
To compress the response window, WordPress.org has activated forced automatic updates for supported branches, attempting to push patches to as many sites as possible without manual oversight. However, installations that have disabled auto-updates or are managed using version control will not receive these fixes automatically and must be upgraded directly by administrators.
The WordPress security team classifies core RCE vulnerabilities as its most critical category, describing them as highest-severity and highest-priority issues. That assessment mirrors industry consensus around remote code execution flaws on internet-facing platforms, where exploitation paths often become widely weaponized soon after patch details are revealed.
Organizations that cannot immediately update are being advised to adopt interim defenses. Security researchers recommend blocking the REST API batch endpoint paths /wp-json/batch/v1 and the alternative query-string route ?rest_route=/batch/v1 at the web application firewall. They also caution that filtering only the pretty permalink form leaves the query-string route open, weakening the benefit of partial mitigation strategies.
These configuration changes are being positioned as stopgap measures rather than long-term solutions. The intent is to narrow the attack surface while security teams test, schedule, and roll out the official WordPress core updates across production environments, especially in complex or tightly regulated deployments.
The open-source nature of WordPress both enables rapid distribution of patches and exposes the exact code changes that correct vulnerabilities. Once the updated source is public, defenders and attackers alike can inspect the modifications, effectively turning the patch into a roadmap for understanding the underlying flaw and building reliable exploits.
At disclosure time, researchers reported no confirmed real-world attacks leveraging wp2shell. Even so, they stress that for core RCE weaknesses affecting globally deployed platforms, the critical period between patch release and widespread adoption is typically counted in hours. During that window, motivated attackers can move quickly to reverse-engineer the fix and automate exploitation at scale.
Given WordPress’s role in powering a significant portion of the world’s websites, any delay in patching amplifies systemic risk. Sites that remain on vulnerable versions face a heightened probability of compromise, while administrators who move quickly to apply WordPress 7.0.2, 6.9.5, or 6.8.6 can substantially reduce their exposure to the wp2shell attack chain and the associated SQL injection flaw.
Read Article: Cosmoserve’s Robotic Capture Test Faces Setback as Petals Fail to Open During Vikram-1 Mission
