wp2shell: WordPress Core RCE Exploited in the Wild as Public PoC Code Circulates

Attackers are already dropping webshells on WordPress sites through a flaw in WordPress Core itself. The bug chain, named wp2shell, delivers an unauthenticated WordPress Core RCE. No plugin, no theme, and no login are needed. A public-facing install is enough to be at risk.

TL;DR

wp2shell chains two flaws, CVE-2026-60137 and CVE-2026-63030, into a pre-auth remote code execution attack on WordPress Core. Wiz Research confirms active exploitation in the wild. Proof-of-concept exploit code and full technical details are public, so unpatched sites face immediate danger.

Why it matters

This is a rare event. Wordfence calls it the first critical unauthenticated WordPress Core RCE in nearly a decade. Because the flaw sits in Core, it hits default installs, not a niche add-on.

The scale is large. According to Wiz, 60% of organizations using WordPress had at least one vulnerable instance when the CVEs dropped. Around 25% exposed a vulnerable server to the internet. Those figures fell to 50% and 10% within 24 hours as teams patched.

Details spread fast, too. Researchers reverse-engineered the patch within days, and working exploits began circulating. You can review the Wiz Research analysis of active wp2shell exploitation for the current threat picture.

How the attack works

The chain combines two separate issues. Together, they turn a public WordPress site into an attacker foothold.

The two flaws

CVE-2026-60137 is an unauthenticated SQL injection tied to the author exclusion query parameter. CVE-2026-63030 is a REST API batch request route-confusion issue. When chained, the route confusion lets attacker-controlled input reach a path that would normally sanitize it.

From injection to admin

Adam Kues of Searchlight Cyber documented the mechanism. The SQL injection feeds a larger chain across post caching, oEmbed cache rows, changesets, and action hooks. The end result is a new administrator account. From there, an attacker can run code with web-server privileges, for example by uploading a plugin.

We are not publishing exploit steps or payloads here. Instead, we point defenders to the vendor writeups for detection detail.

What the exploitation looks like

Wiz observed multiple actors abusing the batch API against cloud-hosted WordPress. Post-exploitation activity included malicious plugin uploads for persistent backdoors and admin-user enumeration. Researchers also saw local file inclusion attempts aimed at WordPress config secrets. Attackers deployed PHP webshells, including one disguised as a fake security plugin. High-volume opportunistic scanning ran alongside the targeted hits.

Affected versions

The exposure depends on which flaw applies. Here are the sourced version ranges.

For the full RCE chain (CVE-2026-63030 and CVE-2026-60137): WordPress Core 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. For the SQL injection alone (CVE-2026-60137): WordPress Core 6.8.0 through 6.8.5. In short, default installs released since December 2025 are affected.

Patch and mitigation steps

Act now if you run WordPress. The security team shipped fixes on July 17, 2026.

• Update WordPress to a fixed release: 7.0.2, 6.9.5, or 6.8.6.
• If you cannot patch yet, block anonymous access to the Batch API at your WAF. That means restricting /wp-json/batch/v1 or the ?rest_route=/batch/v1 route.
• Alternatively, disable anonymous REST API access with a trusted plugin.
• Hunt for signs of compromise, such as unexpected admin accounts, new plugins, or modified files.

Detection is possible. Wiz notes that HTTP 207/200 multi-status responses to batch endpoint requests are a high-fidelity signal. User-agent strings referencing wp2shell also flag purpose-built tools. For patch context, the Wordfence breakdown of the wp2shell aftermath lays out the disclosure timeline and firewall coverage.

Bottom line

This WordPress Core RCE is real, remote, and pre-authentication. Exploitation is confirmed, and public proof-of-concept code raises the stakes by the hour. Patch today, then check your logs for the batch API and webshell indicators above.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.