On July 17, 2026, WordPress pushed a security release that most site owners probably haven't noticed yet. WordPress 7.0.2 patches a vulnerability researchers are calling wp2shell — a critical unauthenticated remote code execution flaw in WordPress core that lets an attacker run arbitrary code on your server without an account, without a login, and without any user interaction. If your site runs WordPress 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1 and it's publicly accessible, you need to update right now.

This isn't a theoretical risk. The vulnerability lives in the WordPress REST API batch endpoint, which is enabled by default on every WordPress installation. According to Searchlight Cyber, the researchers who found it, the flaw can be exploited remotely against a stock WordPress install with no plugins required. That means every default WordPress site on the internet is a target until it's patched.

What wp2shell actually does

The technical details are still partially under wraps — Searchlight Cyber hasn't published a full exploit chain yet as of July 17 — but here's what we know. The vulnerability exists in how WordPress handles batch requests through the REST API. An attacker can craft a malicious batch request that bypasses authentication checks and executes code on the server.

The key detail from Cloudflare's analysis: the vulnerable code path is reachable when a persistent object cache isn't in use. Most shared hosting environments and many VPS setups don't have Redis or Memcached configured, which means they're vulnerable by default. If you're running WordPress on a standard cPanel, Plesk, or similar shared host, you almost certainly fall into this category.

Rapid7, who published the initial analysis, assigned the vulnerability a CVSS score of 7.5, though the GitHub Security Advisory classifies it as Critical. The lower-than-expected score likely reflects some environmental conditions required for exploitation, but the unauthenticated attack path and the sheer number of WordPress installations make this a high-priority patch regardless.

Which versions are affected

The scope is narrow but the installed base is massive:

  • WordPress 6.9.0 through 6.9.4 — affected, fix is 6.9.5
  • WordPress 7.0.0 through 7.0.1 — affected, fix is 7.0.2
  • WordPress 7.1 beta — affected, fix included in 7.1 Beta 2
  • WordPress versions before 6.9 — not affected by this specific CVE

If you're on WordPress 6.8 or earlier, you're safe from wp2shell specifically. But if you updated to 6.9 or 7.0 at any point, you're in the blast radius.

The auto-update situation

WordPress is forcing automatic updates for installations that have auto-updates enabled. That sounds reassuring until you realize how many sites have auto-updates disabled — either deliberately (because a plugin breaks on updates) or accidentally (because someone toggled it off three years ago and forgot).

The WordPress security team started pushing forced updates on July 17, but the rollout isn't instant. Sites behind firewalls, sites with custom update configurations, and sites on managed hosts that control their own update schedules might not get the patch automatically. Don't assume your host handled it. Check.

What to do right now

Open your WordPress admin dashboard. Look at the bottom-right corner. If it says anything other than 6.9.5, 7.0.2, or 7.1 Beta 2, update immediately. If you can't access your dashboard — for example, if you're on a staging site or a headless install — update via WP-CLI with wp core update.

If you're on a managed host like WP Engine, Kinsta, or Flywheel, check their status pages. Most major hosts pushed the patch within hours, but some roll updates out in waves.

For the technically inclined, Rapid7 notes that the exploit isn't yet confirmed in the wild, but they also warn that with open-source code and AI-assisted analysis, a public proof-of-concept is likely days away at most. The window between "patch available" and "exploit in the wild" keeps shrinking. In 2026, it's measured in hours, not weeks.

The bigger picture

WordPress powers roughly 40% of the websites on the internet. When a critical RCE drops in core — not a plugin, not a theme, but the WordPress software itself — the attack surface is enormous. This is the kind of vulnerability that gets weaponized fast.

The last comparable WordPress core RCE was CVE-2024-25600, patched in February 2024. Within 48 hours of disclosure, there were mass exploitation attempts scanning for vulnerable sites. wp2shell follows the same pattern: a default endpoint, no authentication required, code execution on the other side.

Update your sites. Check your clients' sites. If you manage WordPress for anyone else, this is the week to audit every installation you're responsible for.

Sources: Rapid7 — CVE-2026-63030 analysis, WordPress 7.0.2 release announcement, GitHub Security Advisory GHSA-ff9f-jf42-662q