The most surprising thing about the latest WordPress saga is that two separate bugs in core can be chained to hand an unauthenticated attacker a full remote code execution vector. That’s the WordPress wp2shell exploit in a nutshell. It doesn’t need a plugin, a theme, or any prior login. The chain works against a stock install of WordPress 6.9.x and 7.0.x.
Key Takeaways
- Two independent flaws—CVE-2026-63030 and CVE-2026-60137—combine for pre‑auth RCE.
- Public proof‑of‑concept exploits are already on GitHub.
- WordPress forced automatic updates to 7.0.2 and 6.9.5 for affected sites.
- Cloudflare now blocks exploitation attempts at the WAF level.
- Searchlight Cyber offers a wp2shell.com test site for admins.
Historical Context
WordPress has long been a target for security researchers because of its massive install base. Over the past decade, the platform has released a series of emergency patches that address critical core vulnerabilities. Those incidents have shaped the community’s expectations around rapid response and forced updates. The wp2shell chain is the latest illustration of that pattern: a high‑impact flaw appears, the core team issues a patch, and the ecosystem scrambles to mitigate.
Earlier high‑severity incidents, such as the cross‑site scripting and authentication bypass bugs that made headlines, taught developers to keep an eye on the core release notes. Those lessons remain relevant. When a vulnerability can be exploited without any prior authentication, the urgency spikes dramatically. That is why the WordPress security team acted within hours of disclosure, a cadence that mirrors past emergency releases.
In addition to the core team’s response, third‑party services have stepped up their protective layers. Cloudflare’s decision to extend WAF coverage to free accounts follows a trend that began when similar core bugs forced CDN providers to add temporary shields. This historical back‑and‑forth between core developers and the broader infrastructure community forms the backdrop against which the wp2shell exploit unfolds.
WordPress wp2shell exploit: What the flaws are and why they matter
Adam Kues of Searchlight Cyber uncovered the pair of bugs that let an anonymous user run code on vulnerable sites. The research team said, “Searchlight Cyber’s security research team has discovered a pre‑authentication RCE in WordPress Core,” and added that the attack “has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins.” That’s a stark reminder that core code can still harbor critical issues.
Two CVEs, one devastating chain
The first flaw, CVE-2026-63030, is a REST API batch‑route confusion bug introduced in WordPress 6.9. It lets an attacker trick the API into processing crafted batch requests. The second, CVE-2026-60137, is an SQL injection in the author__not_in parameter of WP_Query. WordPress describes it as a high‑severity SQL injection affecting versions 6.8 and later.
When combined, the SQL injection can pull password hashes, and the REST API bug can then execute arbitrary code. That’s why the chain only works on versions where both bugs exist—WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
Patch timeline and forced updates
WordPress responded fast. The security team enabled forced automatic updates for any site running the affected versions. They urged everyone to upgrade to WordPress 7.0.2 or 6.9.5 immediately. “Because this is a security release, it is recommended that you update your sites immediately,” the official announcement read.
Those updates fix both CVEs and break the exploit chain. If you’re still on 6.9.x or 7.0.x, the auto‑update will push you to the safe version unless you’ve disabled automatic updates.
Temporary mitigations and Cloudflare WAF
Not every admin can patch right away. Searchlight Cyber suggested two stop‑gap measures: install a plugin that blocks anonymous REST API access, or block /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF level. They warned those are only temporary fixes.
Cloudflare announced that its WAF now shields both vulnerabilities across all plans, even free accounts. The company said, “WAF protections reduce exposure while customers update, but they are not a substitute for patching.” That means the rules will drop malicious requests targeting the REST batch route and the SQL injection parameter.
Public exploits and real‑world sightings
Searchlight Cyber delayed publishing full technical details, but once the patches were out, multiple public PoC exploits appeared on GitHub. Some combine the two bugs to dump password hashes, then brute‑force an admin password, upload a malicious plugin, and finally run commands. Others claim to achieve direct pre‑auth remote code execution without needing admin credentials, which aligns with the original research description.
watchTowr’s CEO Benjamin Harris told BleepingComputer, “WordPress gets a bad rap for security. But the reality is that a highly impactful, unauthenticated SQL injection or remote code execution vulnerability in WordPress core is actually fairly rare. That is exactly what makes this one different, and why everyone is scrambling to patch before widespread exploitation takes hold. The watchTowr team is already seeing PoC exploits in circulation, and we are beginning…”
That quote underscores how quickly the community is weaponizing the flaws. The presence of public exploits means any unpatched site is effectively exposed.
How to verify if you’re vulnerable
Searchlight Cyber launched wp2shell.com as a testing portal. Administrators can point their site at the service to see if the two CVEs are present. The site doesn’t reveal exploit details, but it does tell you whether you need to rush to update.
- Check your WordPress version. Anything between 6.9.0‑6.9.4 or 7.0.0‑7.0.1 is at risk.
- Run the wp2shell.com test or scan for the REST batch endpoint.
- Confirm automatic updates are enabled; otherwise, apply the patches manually.
- Consider the temporary WAF block if you can’t update immediately.
What This Means For You
If you’re running a WordPress site that hasn’t auto‑updated, you need to verify your version right now. The forced update should have nudged most sites to 7.0.2 or 6.9.5, but some hosted environments disable auto‑updates, leaving them exposed. Deploy the patch, or at least block the REST batch route, before the public exploits start seeing real traffic.
Developers should also audit any custom code that interacts with the REST API or runs WP_Query calls. Even though the core bugs are patched, a similar pattern could appear in plugins that haven’t been hardened. Adding a WAF rule for the batch route or the author__not_in parameter gives you an extra layer while you review your codebase.
Looking ahead, the WordPress community will likely tighten default REST API exposure and improve input sanitization. But until those changes land, the onus remains on site owners to stay current.
Will future WordPress releases adopt a more aggressive default security posture, or will we keep seeing critical core bugs surface after deployment? Only.
Concrete Scenarios for Developers and Site Owners
Scenario 1: A small business runs its site on a shared‑hosting plan that disables automatic updates to avoid accidental breakage. The owner receives a monthly email reminding them to check for updates, but the message is missed. Because the site sits on version 6.9.2, an attacker can issue a single crafted request to the REST batch endpoint and retrieve the admin password hash. In this case, the quickest mitigation is to re‑enable automatic updates or manually apply the 6.9.5 patch. A temporary rule in the host’s firewall that blocks /wp-json/batch/v1 buys the owner a few hours to complete the upgrade.
Scenario 2: An agency manages a portfolio of client sites, each on a different hosting environment. Some clients have explicitly turned off auto‑updates for compliance reasons. The agency runs a nightly scan that flags any site still reporting WordPress 7.0.0. Upon discovery, the team pushes a custom plugin that denies all unauthenticated REST calls. This plugin acts as a stop‑gap while the agency coordinates with each client to schedule a controlled upgrade to 7.0.2. The layered approach—plugin block followed by a scheduled patch—reduces exposure without disrupting client workflows.
Scenario 3: A plugin developer builds a custom extension that uses WP_Query to list posts authored by a dynamic set of users. The code inadvertently passes an unsanitized author__not_in argument derived from a query string. Even though the core vulnerability is patched, the same vector could be re‑introduced through the plugin. A prudent step is to add explicit sanitization and validate the parameter against an allow‑list. Coupled with a WAF rule that inspects incoming author__not_in values, the developer gains defense‑in‑depth against similar future bugs.
Each of these situations highlights a different layer of protection: timely patching, temporary request blocking, and code‑level hardening. The combination of these measures creates a strong safety net.
Key Questions Remaining
- Will WordPress change the default exposure of the REST batch route in upcoming releases?
- How can hosting providers balance automatic updates with the need for stability in enterprise environments?
- What long‑term monitoring tools will emerge to detect similar pre‑auth exploitation attempts?
Answers to these questions will shape the next wave of hardening efforts across the ecosystem. For now, the practical steps remain clear: verify version, apply the patch, and use temporary blocks if you cannot update immediately.
Sources: BleepingComputer, original report
