Critical wp2shell RCE Vulnerability Threatens Millions of WordPress Sites – Emergency Patch Released

Key Takeaways

• A critical pre‑authentication remote code execution (RCE) flaw, nicknamed wp2shell, affects WordPress Core and can be exploited by unauthenticated attackers without any plugins or special configuration.
• The vulnerability stems from a REST API batch‑route confusion that leads to SQL injection and ultimately RCE, tracked as CVE‑2026-63030 (with a related SQL‑i issue CVE‑2026-60137).
• Affected versions include WordPress 6.9.0‑6.9.4, 7.0.0‑7.0.1, and the 7.1 beta; the 6.8 branch is only impacted by the SQL‑i component and has been patched in 6.8.6.
• WordPress.org has released fixes in 7.0.2, 6.9.5, and 6.8.6 and is pushing the update automatically via the auto‑update system due to the severity.
• Site owners should update immediately; temporary work‑arounds (blocking anonymous REST‑API access or the /wp-json/batch/v1 endpoint) are only stopgap measures and may disrupt legitimate functionality.

Overview of the wp2shell Vulnerability
The wp2shell flaw represents a severe pre‑authentication RCE vulnerability discovered in WordPress Core by security researcher Adam Kues of Searchlight Cyber’s Assetnote team. Unlike many WordPress exploits that rely on vulnerable plugins, themes, or misconfigurations, wp2shell can be triggered against a completely stock installation with no plugins installed and no authentication required. This zero‑click, no‑plugin nature dramatically widens the attack surface, putting an estimated 500 million + WordPress sites at risk of full compromise. The researcher responsibly withheld detailed exploit code to allow administrators time to apply patches, while providing a free public scanner at wp2shell[.]com for quick vulnerability checks.

Technical Root Cause: REST API Batch‑Route Confusion
At the heart of wp2shell lies a confusion in the WordPress REST API’s batch routing mechanism. When an attacker crafts a request that abuses the /wp-json/batch/v1 endpoint (or the equivalent query‑string variant ?rest_route=/batch/v1), the API incorrectly processes nested batch sub‑requests. This mishandling enables an SQL injection vector that can be leveraged to execute arbitrary PHP code on the server. The injection does not require any valid user credentials; the request is treated as a legitimate API call, bypassing standard authentication checks. Consequently, an unauthenticated remote attacker can achieve full control over the hosting environment, including file system access, database manipulation, and the ability to install malicious payloads.

Exploitation Requirements and Impact
Exploiting wp2shell is remarkably simple: the attacker only needs network reachability to the target WordPress instance’s REST API. No login session, no active plugin, and no specific server configuration are necessary. Once the malicious batch request is sent, the underlying SQL injection can be chained to achieve remote code execution, effectively granting the attacker the same privileges as the web server process (often the www-data or apache user). This level of access permits data theft, defacement, installation of backdoors, ransomware deployment, or use of the compromised site as a pivot point for further network attacks. Given the default exposure of the REST API in WordPress, the vulnerability is effectively “zero‑click” for any internet‑facing site.

Affected WordPress Versions
The vulnerability impacts a specific band of releases, identified by two CVE numbers:

• CVE‑2026-60137 – covers a separate SQL‑i issue that affects the 6.8 branch.
• CVE‑2026-63030 – denotes the batch‑route RCE chain discovered by Kues.

According to the advisory, the following versions are vulnerable to the RCE chain:

• WordPress 6.9.0 through 6.9.4
• WordPress 7.0.0 through 7.0.1
• The 7.1 beta (pre‑release)

Notably, the 6.8.x series is only affected by the SQL‑i component (CVE‑2026-60137); the RCE chain does not apply there. A fix for the SQL‑i issue has been backported to WordPress 6.8.6, while the full RCE remedy appears in the newer releases listed below.

Official Patches and Update Guidance
WordPress.org responded swiftly by releasing version 7.0.2, which addresses both the critical RCE flaw and the associated SQL‑i vulnerability. In addition, backported patches were issued for the older stable lines: version 6.9.5 and version 6.8.6. Recognizing the extreme severity and the massive install base, the WordPress security team took the uncommon step of force‑pushing these updates via the automatic background update mechanism. This ensures that sites running affected versions receive the patch even if administrators have not manually triggered an update.

For those who prefer manual control, the update can be applied through the WordPress Dashboard: navigate to Dashboard → Updates and click “Update Now.” Alternatively, administrators can download the full release package directly from WordPress.org and replace the core files via FTP or the host’s file manager. After updating, it is prudent to verify the site’s version number and confirm that the REST API batch endpoint no longer accepts malicious payloads (using the provided scanner or manual testing).

Temporary Mitigations and Their Limitations
If immediate patching is not feasible, Searchlight Cyber recommends two emergency stop‑gap measures, stressing that they are temporary only and may interfere with legitimate site functionality:

1. Install a plugin that blocks anonymous access to the REST API – This prevents unauthenticated users from reaching any REST endpoint, including the vulnerable batch route. However, many legitimate features (such as the Gutenberg editor, mobile apps, or third‑party integrations) rely on REST API access, so blocking it broadly can break site workflows.

2. Block the specific batch endpoints at the WAF level – Configuring a web application firewall to reject requests to /wp-json/batch/v1 or query strings containing ?rest_route=/batch/v1 stops the exploit vector while leaving other REST routes open. This approach requires a capable WAF and careful rule tuning to avoid false positives that could disrupt admin AJAX calls or API‑dependent plugins.

Both measures should be removed as soon as the official patch is applied, as they only reduce risk rather than eliminate the underlying vulnerability.

Conclusion and Recommendations
The wp2shell vulnerability underscores the importance of maintaining a current WordPress core installation, even when no plugins or themes are in use. Its exploitation requires nothing more than a reachable WordPress site, making it a potent threat to the vast majority of the web. Administrators should prioritize applying the released patches (7.0.2, 6.9.5, or 6.8.6) immediately, leveraging the forced auto‑update where possible, and verify the update’s success. Temporary work‑arounds may provide short‑term relief but are not substitutes for a proper patch. By acting swiftly, site owners can close this critical RCE gap and protect their sites, data, and visitors from potential compromise.