On July 17, 2026, WordPress implemented urgent patches for two interconnected vulnerabilities known as WP2Shell.
This action followed the revelation by researchers that these weaknesses allowed an anonymous attacker to exploit a standard installation of WordPress devoid of plugins.
Confirmations of active exploitation from multiple security firms have surfaced, indicating a pressing need for vigilance among site administrators of unpatched instances.
Quick Summary – TLDR:
- On July 17, 2026, WordPress addressed the WP2Shell vulnerabilities by releasing versions 6.9.5 and 7.0.2, effectively closing both security gaps.
- The exploitation of these vulnerabilities enables attackers to gain unauthenticated remote code execution on affected WordPress websites, as detailed in the NVD’s vulnerability documentation.
- Due to the critical nature of these vulnerabilities, WordPress developers have activated forced automatic updates for the impacted sites.
- Reports indicate that exploitation is ongoing in the wild, with public proof-of-concept exploit code already circulating, as evidenced by findings from Patchstack, Hexastrike, and WatchTowr.
- According to Searchlight Cyber, more than 500 million websites are powered by WordPress, amplifying the concern around these vulnerabilities.
What Happened?
The vulnerabilities, designated as CVE-2026-60137 and CVE-2026-63030, were identified by distinct groups of researchers.
One team illuminated the SQL injection flaw, while Adam Kues from Assetnote / Searchlight Cyber unveiled a REST API batch-route confusion coupled with SQL injection, ultimately enabling remote code execution.
CVE-2026-60137 ranks as a high-severity SQL injection bug, whereas CVE-2026-63030 is considered a critical vulnerability permitting arbitrary code execution.
The NVD differentiates severity assessments, with WPScan’s CNA scoring yielding a 9.8 CRITICAL rating for CVE-2026-63030, and CISA-ADP assigning it a 7.5 HIGH designation.
WordPress versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 remain vulnerable to the full exploit chain. The attack requires no preconditions and can be executed by an anonymous user utilizing a standard WordPress installation without plugins.
Additionally, WordPress has retrofitted a fix for the SQL injection issue in version 6.8.6, as this flaw predates the batch-route bug responsible for the complete code execution vulnerability.
A WordPress RCE that doesn’t even need a plugin to ruin your day.
wp2shell (CVE-2026-63030 + CVE-2026-60137) is a pre-auth RCE chain in WP core. No login needed. Exploit code is already in the wild.
Use our free checker (no signup) to verify your exposure, mitigate the risk,… pic.twitter.com/1S1cw0z1ss
— SOCRadar® (@socradar) July 20, 2026
Inside the WP2Shell Attack Chain
This exploit amalgamates two distinct design flaws, as elucidated by a technical analysis from Patchstack.
The pivotal vulnerability resides in an unauthenticated SQL injection accessible via the REST API’s batch endpoint, which is compromised due to route and handler confusion that undermines input validation.
NVD outlines this chain as an issue stemming from the REST API batch endpoint route confusion, in conjunction with the author__not_in WP_Query SQL injection identified as CVE-2026-60137, enabling SQL injection with consequent remote code execution capabilities.
Patchstack has independently corroborated that these combined vulnerabilities can lead to comprehensive site takeovers, including remote code execution.
Exploitation attempts have already been documented in their logs, following the implementation of detection protocols.
Meanwhile, Cloudflare has rolled out protective measures to identify exploitation attempts and safeguard clients whose installations are yet to receive the necessary patches.
With WordPress serving hundreds of millions of websites globally, some will benefit from automatic updates administered by their hosting providers, but numerous others remain unprotected, paving the way for potential exploitation.
Harris emphasized a broader trend highlighted by the rapid escalation from disclosure to attack, noting that this case exemplifies the increasing speed with which AI-assisted tools surface vulnerabilities.
Proof-of-concept exploits emerged within hours of public disclosure—an unprecedented acceleration compared to traditional timelines, which often spanned 24 hours or more.
This contraction in response time carries significant implications. Defenders who previously had a full day to react are now facing mere hours, converting a relaxed patch cycle into an urgent necessity for any exposed WordPress installations.
What This Means for Site Owners?
While forced auto-updates address many of the vulnerabilities, they do not guarantee comprehensive coverage for every site.
Each site’s auto-update system remains critical; therefore, sites where owners or hosts have disabled these updates, or where a custom deployment pipeline is employed, will not automatically receive the patch.
These configurations pose a significant risk, rendering installations susceptible to the unauthenticated exploit chain more than a week post-patch release.
Site owners managing updates manually should ensure they are operating WordPress 7.0.2, or 6.9.5 within the 6.9 branch, or 6.8.6 within the 6.8 branch, rather than assuming the host has applied the requisite updates.
Reviewing recent administrative accounts for any unfamiliar activity is prudent, especially given the confirmed exploitation in the wild.
However, no update or firewall rule can guarantee that compromised sites were secured prior to the patch deployment; these measures merely serve to minimize exposure.
SQ Magazine’s Takeaway
WP2Shell is emblematic not solely of a singular weak parameter but rather signifies how scant the distance now is between public disclosures and operational, unauthenticated exploits targeting one of the internet’s most prevalent software platforms.
WordPress’s proactive stance to compel updates rather than simply announce them signals an acute awareness of the precariousness of this landscape; the traditional disclosure-to-response cycle is no longer sufficient to outpace entering threats.
Looking Ahead: Expect hosting providers to disseminate their patch-compliance metrics in the forthcoming days, alongside continuous updates on exploitation statistics from Patchstack, Hexastrike, and WatchTowr as more honeypot data is collected.
Site owners on managed hosting environments should verify the application of the forced update instead of presuming compliance, while those utilizing custom deployment pipelines that obstruct auto-updates must regard this as a pressing issue necessitating immediate remedial action.
Source link: Sqmagazine.co.uk.
