WP2Shell in WordPress is the public name for a chain of two recent vulnerabilities in WordPress Core: CVE-2026-60137 and CVE-2026-63030. When combined, they can allow an attacker without an account or credentials to compromise a default WordPress installation and execute code on the server.
Unlike many WordPress security incidents, this case does not depend on a vulnerable plugin or theme. The flaws are in WordPress Core and affect specific releases in the 6.8, 6.9, and 7.0 branches. WordPress released fixes on July 17, 2026 and enabled forced automatic updates for affected installations that support them.
Quick answer: update WordPress 6.8 to at least 6.8.6, WordPress 6.9 to 6.9.5, and WordPress 7.0 to 7.0.2. After patching, verify administrators, file integrity, and historical access logs.
What is WP2Shell and why is it different?
WP2Shell is not a third CVE. It is the name used for an attack chain made of two separate weaknesses. The first provides an SQL injection condition in WP_Query; the second creates route confusion in REST API batch processing. On affected branches, their interaction can remove the authentication requirement and provide a path to remote code execution.
This changes the operational priority. A flaw that requires a valid account usually has a narrower attack surface. The WP2Shell chain can target a default Internet-facing installation without administrator interaction and without relying on third-party extensions.
The official WordPress 7.0.2 release identifies one critical and one high-severity issue, confirms that fixes were shipped for affected branches, and recommends immediate updates.
How CVE-2026-60137 and CVE-2026-63030 work
CVE-2026-60137: SQL injection in WP_Query
CVE-2026-60137 affects the handling of the author__not_in parameter in WP_Query. Insufficient preparation and validation of certain values can facilitate SQL injection on vulnerable versions.
SQL injection can let an attacker alter database queries and access information that should not be returned. The official GitHub advisory for CVE-2026-60137 lists WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, and 7.0.0–7.0.1 as affected.
CVE-2026-63030: REST API route confusion
CVE-2026-63030 involves the REST API batch request endpoint. A mismatch between the route that is validated and the route that is eventually dispatched can allow a subrequest to reach a different callback and bypass restrictions intended to prevent that route from being processed in a batch.
When combined with CVE-2026-60137, the result can be unauthenticated remote code execution. The official CVE-2026-63030 advisory rates the issue critical and confirms that WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 are affected.
Affected and patched WordPress versions
| WordPress branch | Risk | Vulnerable versions | Fixed version |
|---|---|---|---|
| 6.8 | CVE-2026-60137; not listed as affected by the complete RCE chain | 6.8.0 to 6.8.5 | 6.8.6 or later |
| 6.9 | Both CVEs and the WP2Shell RCE chain | 6.9.0 to 6.9.4 | 6.9.5 or later |
| 7.0 | Both CVEs and the WP2Shell RCE chain | 7.0.0 to 7.0.1 | 7.0.2 or later |
| 7.1 beta | The first beta was affected | 7.1 beta 1 | 7.1 beta 2 |
| Earlier than 6.8 | Not affected by these CVEs according to WordPress | Not applicable | Still migrate to a maintained release |
An older branch being unaffected by WP2Shell does not make it secure. It may contain other known flaws and lack active support. Staying on an obsolete release is not a safe mitigation.
Is WP2Shell being exploited?
The disclosure moved quickly. VulnCheck reported emerging Internet activity and said it had verified more than two dozen proof-of-concept implementations by July 19. Public PoCs significantly lower the expertise required to probe unpatched installations.
A request to the related endpoint does not prove compromise by itself because automated scanners also generate reconnaissance traffic. However, suspicious requests against a site that remained vulnerable should trigger an integrity review, not only a software update.
Potential impact of a successful attack
Read or extract data from the WordPress database.
Create or modify administrator accounts.
Install a webshell or malicious PHP files.
Modify themes, plugins, content, or redirects.
Steal secrets from
wp-config.phpor environment variables.Use the site for malware, spam, or phishing.
Maintain persistence through scheduled tasks, fake plugins, or hidden users.
Hosting isolation matters. Each site should run under its own user with appropriate file, process, and database boundaries so that one WordPress compromise does not automatically expose other accounts.
How to patch WP2Shell
1. Check the installed version
wp core version2. Create a verified backup
Back up the database and files before changing production, especially for WooCommerce, membership, and other business-critical sites. Do not use the backup process as a reason to delay the patch.
3. Install the security update
wp core update
wp core versionIf compatibility requires temporarily staying on a specific branch, install at least 6.8.6, 6.9.5, or 7.0.2 as appropriate. Test the frontend, dashboard, forms, payments, and scheduled tasks afterward.
4. Verify WordPress Core checksums
wp core verify-checksumsThis checks Core files against official packages. It does not examine all of wp-content, uploads, or database content, so it is not a complete incident-response scan.
How to check for possible compromise
Review administrator accounts
wp user list --role=administratorLook for PHP files inside uploads
find wp-content/uploads -type f -name '*.php' -printFind recently modified PHP files
find . -type f -name '*.php' -mtime -7 -printSearch web server logs for batch endpoint traffic
grep -R "/wp-json/batch/v1" /var/log/nginx/ /var/log/apache2/ 2>/dev/nullCorrelate source IP, time, response code, request volume, follow-up activity, and file changes. Endpoint traffic alone is not proof of exploitation.
Temporary mitigations when an immediate update is impossible
The primary fix is to install the patch. As temporary containment, a WAF can block or restrict anonymous requests to /wp-json/batch/v1. This may break plugins or integrations that depend on REST API batch processing, so test it and remove the workaround after updating.
Hiding the WordPress version, changing the login URL, or adding a security plugin does not fix vulnerable Core code. Forced automatic updates are also not a guarantee: file permissions, configuration constants, or provider policies can prevent completion.
What to do when you find signs of exploitation
Isolate the site while preserving logs and a forensic copy.
Update WordPress from an official source.
Reinstall legitimate Core and extension packages.
Remove unauthorized accounts and persistence mechanisms.
Change administrator, database, SFTP, and hosting-panel passwords.
Rotate API keys and application secrets.
Refresh WordPress salts to invalidate sessions.
Review other sites sharing users, permissions, or credentials.
Monitor logins, traffic, and file changes after cleanup.
A backup helps only when it predates the compromise and the vulnerability is patched before the site returns online.
WP2Shell WordPress FAQ
Does WP2Shell affect every WordPress site?
No. The full chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. WordPress 6.8.0–6.8.5 is affected by CVE-2026-60137.
Is a vulnerable plugin required?
No. These vulnerabilities are in WordPress Core. Plugins and themes may increase post-exploitation impact, but they are not a requirement for the disclosed chain.
Does the attacker need an account?
The full chain can be exploited without authentication on affected versions, which is why the update is urgent.
Which version should I install?
Install the latest stable version supported by your site. At minimum, use WordPress 6.8.6, 6.9.5, or 7.0.2 according to your branch.
Does a WAF replace the update?
No. A WAF can block known attempts and buy time, but the patch removes the root cause. Security rules are an additional layer.
Response checklist for CVE-2026-63030 and CVE-2026-60137
Inventory every WordPress installation and its actual version.
Update to 6.8.6, 6.9.5, 7.0.2, or later.
Confirm completion instead of assuming automatic updates worked.
Run
wp core verify-checksums.Review administrators and recently modified PHP files.
Search historical logs for
/wp-json/batch/v1.Rotate credentials if compromise is detected or cannot be ruled out.
Verify backups and continue monitoring changes.
Enforce account isolation and least privilege at the hosting layer.
Conclusion
WP2Shell deserves immediate attention because it chains two WordPress Core flaws, can reach unauthenticated RCE on affected versions, and now has public research and proof-of-concept implementations. The correct response is straightforward: inventory, patch, verify, and investigate unusual activity.
In a managed WordPress hosting environment, isolation, backups, and monitoring help contain the impact of critical vulnerabilities. You can also read our analysis of CVE-2026-4020 in Gravity SMTP to understand the difference between a plugin flaw and a WordPress Core vulnerability.
