wp2shell: The WordPress Core RCE That Has Attackers Scanning the Internet Right Now

On July 17, 2026, WordPress shipped emergency patches for two vulnerabilities that, when chained together, let any anonymous visitor take over a default WordPress installation with a single HTTP request. No login. No plugin. No user interaction. The vulnerabilities are tracked as CVE-2026-63030 and CVE-2026-60137. The security community has given the chain a name: wp2shell.

Nine days later, on July 26, exploitation is widespread. Cloudflare, Wiz, and watchTowr have all confirmed mass scanning across the internet. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on July 21. If you run WordPress 6.9.x or 7.0.x and you have not patched to 6.9.5 or 7.0.2, this post is your nudge to stop reading and go update right now.

What wp2shell actually does

The exploit chain is two bugs working together.

CVE-2026-63030 is a logic flaw in the WordPress REST API batch endpoint at /wp-json/batch/v1. The batch processor validates sub-requests and executes them in separate loops. When wp_parse_url() fails on a sub-request path, the error gets pushed to the validation array but not the matches array. This desynchronizes the two arrays, which means every request after the malformed one dispatches under the wrong handler. The practical effect: an attacker can bypass authentication checks on internal API handlers.

CVE-2026-60137 is a SQL injection in the author__not_in parameter of the posts endpoint. On its own, parameter validation blocks the injection. But the batch API desynchronization from CVE-2026-63030 lets an attacker bypass that validation. A recursive batch call sidesteps the GET-method restrictions, yielding a pre-authentication UNION-based SQL injection.

Neither bug alone gets you remote code execution. Chained together, they do. The attacker uses the SQL injection to create an administrator account, logs in, uploads a malicious plugin, and has a shell. The whole process takes seconds.

Searchlight Cyber discovered the chain using OpenAI's GPT 5.6 Sol model during a research session that ran just over ten hours. That detail matters. The barrier to finding and reproducing critical vulnerabilities is dropping because AI-assisted analysis makes the tedious parts of exploit development fast. The same tools that help defenders audit code also help attackers chain bugs.

Who is affected

Every WordPress installation running versions 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1 is vulnerable. That is WordPress released since December 2025. Earlier versions (6.8.x and below) are not affected by the RCE chain, though the SQL injection component exists from 6.8 onward.

Cloudflare has noted one caveat: the RCE path requires that the site does not use a persistent object cache (Redis, Memcached). Sites with object caching enabled are still vulnerable to the SQL injection but cannot be escalated to full RCE through this particular chain. That is not a reason to skip the patch. It is a reason to set up object caching and update.

Wiz telemetry shows that 60 percent of organizations using WordPress had at least one vulnerable instance when the CVEs were published. Twenty-five percent were exposing a vulnerable server directly to the internet. Those numbers have dropped since July 17, but not fast enough.

What attackers are doing with it

The post-exploitation playbook is textbook. watchTowr reported that successful exploitation started within hours of the initial disclosure, first exfiltrating hashed credentials and then escalating to RCE once full technical details went public. Wiz has observed the following activity in the wild:

Attackers are uploading malicious plugins that provide persistent backdoor access. They are enumerating users and harvesting administrator usernames and email addresses. They are performing local file inclusion attacks to steal database credentials and WordPress authentication keys. They are accessing wp-admin and authenticating with the accounts they just created. They are dropping PHP web shells for ongoing remote access.

KEVIntel has tracked exploitation activity from at least 13 unique IP addresses across Switzerland, Germany, the UK, Indonesia, Lithuania, the Netherlands, and Singapore. The scanning is not targeted. It is opportunistic mass scanning looking for any WordPress site that has not patched.

What you need to do

Update immediately. WordPress 6.9.5 and 7.0.2 contain the fixes. WordPress is forcing automatic updates for affected installations, but you should verify manually. Do not assume your host handled it. Log in, check the version number in the admin footer, and confirm.

Check for compromise. Patching closes the door, but if an attacker got in before you patched, they are still inside. Review your HTTP access logs for unusual requests to /wp-json/batch/v1. Look for unfamiliar plugins in wp-content/plugins/. Check for PHP files that should not be there. Compare your wp_users table against a known-good backup. If you find anything suspicious, restore from a pre-July-17 backup and then patch.

Block the endpoint if you cannot update right now. If you are running a custom WordPress setup where updating requires testing first, block /wp-json/batch/v1 and ?rest_route=/batch/v1 at your web application firewall or nginx configuration. This is a temporary measure, not a fix.

Enable a persistent object cache. Redis or Memcached will not fully protect you (the SQL injection still works), but it blocks the RCE escalation path. If you are on managed hosting, your host likely offers this as a one-click toggle.

Audit your plugins and themes. The SQL injection component (CVE-2026-60137) exists from WordPress 6.8 onward. Plugins that pass untrusted data to WP_Query's author__not_in parameter without sanitization are independently vulnerable. Update everything.

The bigger picture

wp2shell is the first critical unauthenticated RCE in WordPress Core in nearly a decade. The last one that came close was in 2017. The fact that it was found with the help of an AI model, reproduced by multiple research teams within days, and actively exploited within hours of disclosure is a preview of how the vulnerability lifecycle is compressing.

The window between "patch available" and "mass exploitation" used to be measured in weeks. It is now measured in hours. WordPress powers more than 40 percent of the web. When a Core vulnerability drops, the scanning starts before most site owners finish their morning coffee.

Update your sites. Check your logs. And if you have been putting off setting up automatic updates, this is the vulnerability that should change your mind.

Sources: Rapid7 CVE-2026-63030 analysis, The Hacker News — wp2shell exploitation grows, Wiz — wp2shell research, WordPress 7.0.2 release