wp2shell: pre-auth RCE in WordPress core (CVE-2026-63030)

WordPress patched wp2shell, a pre-authentication remote code execution chain in its core REST API, in an emergency 7.0.2 release on July 17, 2026, and pushed forced auto-updates to affected sites. Disclosed by Assetnote and Searchlight Cyber researcher Adam Kues, the chain pairs a REST batch-route confusion bug (CVE-2026-63030) with a core SQL injection (CVE-2026-60137) to reach code execution on a stock install with no login required. WordPress powers over 500 million sites, so exposure is enormous.

What is wp2shell?

wp2shell is a pre-authentication remote code execution chain in WordPress core, not in a plugin. It combines two separate flaws. The first, CVE-2026-63030, is a route-confusion bug in the REST API batch endpoint (/wp-json/batch/v1) that functions as an authentication bypass. The second, CVE-2026-60137, is a critical SQL injection in the author__not_in parameter of WP_Query. On its own the SQL injection needs authentication. The batch-route bug removes that requirement, and the two together turn an anonymous request into full site compromise. Because the flaws live in core, a default WordPress install with no plugins is vulnerable.

Which WordPress versions are affected?

The RCE chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The SQL injection reaches back further, to the 6.8.x branch. WordPress released fixes across every supported branch and, given the severity, enabled forced updates through the auto-update system for sites running affected versions.

How does the wp2shell exploit chain work?

The attack is a chain, not a single silver bullet, and understanding the steps matters for detection. First, the batch-route confusion bug desynchronizes how the REST batch dispatcher maps requests to their permission checks, so an anonymous request is validated against the wrong handler and the authentication requirement falls away. That unlocks the SQL injection, which an attacker uses to dump the database. From the dump they lift the administrator password hash, crack it offline, and log in as admin. On a stock WordPress site, administrator access is effectively code execution: the built-in theme and plugin file editors let an admin write PHP, which is the final step to a web shell.

Who found wp2shell, and how was it disclosed?

The RCE chain was reported by Adam Kues, a researcher with Assetnote, part of Searchlight Cyber, who published the technical writeup and a public exposure checker at wp2shell.com. Kues, who posts as hashkitten (@hash_kitten), announced the disclosure on X, noting that the flaw can be exploited with no preconditions. WordPress core’s security team separately credited TF1T, dtro, and haongo for reporting the underlying SQL injection. This was a coordinated disclosure: technical details were held back at first to give defenders time to patch before proof-of-concept code circulated.

Is wp2shell being exploited in the wild?

Yes, early exploitation has been reported. Proof-of-concept material became public shortly after the patch, and monitoring vendors including PatchStack reported early in-the-wild activity against unpatched sites. That pattern is typical: once a core WordPress fix ships, attackers diff the patch to reconstruct the bug, and mass scanning follows within days. A pre-authentication chain that needs no plugins is exactly the kind of flaw that gets weaponized quickly by initial access brokers who resell footholds to ransomware crews. You can watch downstream victim listings on the Ransomtracker live feed.

Update: a working wp2shell exploit is now public

As of July 19, 2026, the risk has escalated sharply. A working exploit for wp2shell is now publicly available, matching Rapid7’s warning that a proof of concept would appear quickly once the patch shipped and the fix could be reverse engineered. The tool, published as Ultimate-wp2shell by a user going by codeb0ss, is hosted openly on GitHub under an MIT license with an “educational and authorized testing only” disclaimer, and is being mirrored and promoted through a Telegram channel called Omnipotent Forums. The Telegram post bundles the exploit with search-engine queries for locating vulnerable WordPress sites at scale. Ransomnews reviewed both but is not linking the exploit or reproducing the target-finding queries: a disclaimer does not change what a free, working, pre-authentication RCE against a stock install does in the wrong hands.

The practical takeaway is blunt: the barrier to exploitation has collapsed. What began as a coordinated disclosure with technical details deliberately withheld is now a free, point-and-click download, bundled with instructions for finding targets. The “for research purposes” label on the repository does not undo that, and a free public exploit for an unauthenticated bug is exactly the raw material that opportunistic operators and ransomware crews feed on. Any internet-facing WordPress site still running an affected version should be treated as actively at risk, not theoretically vulnerable, and mass scanning should be assumed.

What should WordPress site owners do now?

Update to WordPress 7.0.2, 6.9.5, or 6.8.6 immediately, whichever matches your branch. Most sites on affected versions should already have received the forced auto-update, but verify it applied rather than assuming: check your installed version in the admin dashboard. To test whether a site is exposed, run it through the researchers’ public checker at wp2shell.com, which fingerprints the vulnerable versions without exploiting them. If you cannot patch at once, block requests to /wp-json/batch/v1 at your WAF or reverse proxy and restrict anonymous REST API access as a stopgap. After patching, treat any previously exposed site as potentially compromised: rotate all administrator passwords and secret keys, review user accounts for unauthorized admins, and hunt for newly modified theme or plugin PHP files and unexpected files in the uploads directory. For layered controls, see our guide to business ransomware protection.

Why wp2shell matters

Pre-authentication RCE in WordPress core is rare and serious. Most WordPress compromises come through vulnerable plugins or weak credentials, not the core platform, which is why this chain stands out. The realistic risk is scale: with hundreds of millions of sites and forced auto-updates that not every install honors, a long tail of unpatched, internet-facing WordPress will remain exploitable for months. Those sites become cheap initial access, and initial access is the raw material of the ransomware economy. Patching fast is not just hygiene here, it is the difference between a closed door and an open one.

Frequently asked questions

Sources and further reading

• Searchlight Cyber: wp2shell, pre-authentication RCE in WordPress core (Adam Kues)
• WordPress.org: WordPress 7.0.2 security release
• VulnCheck: WP2Shell vulnerabilities CVE-2026-60137 and CVE-2026-63030
• Rapid7: Emergency Threat Response for CVE-2026-63030 (wp2shell)
• The Hacker News: New wp2shell WordPress core flaw lets unauthenticated attackers run code
• Help Net Security: Two new high-severity WordPress vulnerabilities, patch immediately
• Adam Kues (hashkitten) on X