If you manage any WordPress site, stop what you’re doing right now.
On July 17, a critical vulnerability (CVE‑2026‑63030) was disclosed in WordPress core that lets unauthenticated attackers execute arbitrary code. Public proof‑of‑concept exploits are already out there. The attack chain is being called “wp2shell.”
This isn’t one of those bugs that requires a niche plugin or exotic configuration. It works on default installations. In short, anyone can send a single HTTP request and take over your site.
Which versions are affected?
- Full RCE risk: WordPress 6.9.0 – 6.9.4, and 7.0.0 – 7.0.1.
- SQL injection only (no direct RCE): WordPress 6.8.0 – 6.8.5.
I’ve patched mine – now you need to, too
The WordPress team released fixed versions on the same day:
- 6.9.x → update to 6.9.5
- 7.0.x → update to 7.0.2
- 6.8.x → update to 6.8.6 (fixes the SQLi)
- 7.1 beta → update to 7.1 beta2
Automatic updates have been force‑enabled for all affected branches. But don’t assume it worked. Log into your dashboard, go to “Dashboard” → “Updates,” and verify you’re on one of the safe versions above.
What’s happening under the hood
wp2shell is actually two bugs chained together:
- CVE‑2026‑63030 – a routing mix‑up in the REST API batch endpoint. Attackers can craft a request that tricks WordPress into handing it off to an unauthorised handler, bypassing authentication.
- CVE‑2026‑60137 – an SQL injection in WP_Query’s author__not_in parameter, letting attackers inject malicious SQL into the database query.
Together, they first bypass login checks, then steal admin password hashes via SQLi, and finally execute code on the server.
Can’t update right away? Temporary workarounds
If you absolutely cannot apply the patch immediately, consider these stopgaps:
- Install a plugin that blocks anonymous REST API access.
- Or configure your WAF/server to block these two paths:
- /wp-json/batch/v1
- ?rest_route=/batch/v1
One last thing
WordPress powers over 500 million websites. Attackers are already scanning for unpatched targets. This isn’t a “maybe” – it’s happening now. Check your site and update today. Don’t wait until tomorrow.
Tags:
Technology