WordPress site administrators face an urgent security alert following the rapid exploitation of critical vulnerabilities tracked as CVE-2026-63030 and CVE-2026-60137. These flaws, collectively dubbed “wp2shell,” allow attackers to achieve unauthenticated remote code execution (RCE) on affected WordPress installations, even without plugins or specific authentication. Patches were released in WordPress versions 6.9.5 and 7.0.2, but exploitation began in the wild shortly after disclosure.
The severity of these issues prompted WordPress to enable forced automatic updates for vulnerable installations, including pre-release versions like WordPress 7.1 beta2. Security firms confirmed in-the-wild exploitation within hours of the patches becoming publicly available. This rapid weaponization highlights a shrinking window between vulnerability disclosure and active attacks, demanding immediate attention from anyone managing a WordPress site.
Critical Flaws Allow Remote Code Execution
The primary vulnerability, CVE-2026-63030, is described as a “REST API batch-route confusion and SQL injection” issue. It enables remote code execution through the REST API batch endpoint, located at `/wp-json/batch/v1` or its legacy alias `?rest_route=/batch/v1`. This flaw is particularly dangerous because it requires only a single anonymous web request for exploitation, bypassing common security layers like authentication or third-party code.
Adam Kues of Assetnote, a division of Searchlight Cyber, discovered CVE-2026-63030 through the WordPress HackerOne program. The affected versions for this specific flaw include WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Searchlight Cyber intentionally withheld technical details to give defenders adequate time to update their systems, citing the egregious nature of the flaw.
Second SQL Injection and Chained Attacks
A second, high-severity SQL injection vulnerability, CVE-2026-60137, was also addressed in the same security release. Researchers TF1T, dtro, and haongo reported this issue. Unlike the wp2shell vulnerability, CVE-2026-60137 predates the latest release and was backported to WordPress 6.8.6. Chaining both CVE-2026-60137 and CVE-2026-63030 allows an attacker to achieve unauthenticated remote code execution on vulnerable WordPress websites.
While WordPress classified CVE-2026-63030 as “high severity,” some advisories, such as the GitHub Security Advisory GHSA-ff9f-jf42-662q, labeled it as critical with a CVSS score of 7.5. Regardless of the classification, the potential for unauthenticated RCE underscores the necessity of immediate patching for all affected systems.
Rapid Exploitation Demands Immediate Action
The window between disclosure and active exploitation for these vulnerabilities proved to be exceptionally short. WordPress announced patches on a Friday, and by the early hours of the following Saturday morning, successful exploitation attempts were already underway. Cybersecurity firms, including Patchstack and Hexastrike, observed exploitation attempts in their honeypots and assisted with incident response for several attacks.
WatchTowr also confirmed in-the-wild exploitation, with its CEO and founder, Benjamin Harris, noting the speed at which proof-of-concept (PoC) exploits emerged. This rapid weaponization, potentially aided by AI-assisted tooling, has significantly compressed the time administrators have to patch their systems. Many WordPress hosting providers automatically update their installations, but a large number of self-managed sites remain at risk.
Cloudflare responded by rolling out rules designed to detect exploitation attempts and protect customers whose WordPress installations were not immediately patched. This layered defense highlights the importance of comprehensive security measures beyond just core software updates. For administrators managing their own WordPress hosting, verifying successful updates is a critical step.
Verifying Updates and Ongoing Vigilance
Site administrators must confirm that all internet-facing WordPress installations have successfully applied the security patches. This includes verifying that versions 6.9.5 or 7.0.2, or later, are running. The proactive measure of forced automatic updates by WordPress helps secure many sites, but manual verification ensures full protection against these critical flaws, especially for those running shared hosting or custom environments.
The rapid exploitation of the wp2shell vulnerabilities underscores a broader trend in cybersecurity where the time between a vulnerability’s public disclosure and its active weaponization is shrinking. This necessitates constant vigilance, timely updates, and robust incident response planning for all WordPress administrators to maintain site integrity and security.
