“wp2shell” The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade — What It Means for Your Site
If you run a WordPress website, this is one of the more serious security stories of the year — and it’s worth understanding even if you’re not a technical person.
What happened
A newly disclosed WordPress exploit chain, nicknamed “WP2Shell,” lets unauthenticated attackers achieve remote code execution on any WordPress Core installation, with no plugins required. In plain English: an attacker doesn’t need a login, a password, or a vulnerable plugin to take over an affected site. They just need the site to be running an exposed version of WordPress Core itself.
Security researcher Adam Kues of Searchlight Cyber’s Assetnote research team uncovered the flaw, and Searchlight Cyber described the attack as having “no preconditions,” exploitable “by an anonymous user in a stock install of WordPress with no plugins.” Given how widely WordPress is used, that’s a big deal — Searchlight Cyber estimates the platform powers well over 500 million websites.
The technical short version
The issue isn’t a single bug, but two separate flaws chained together.
CVE-2026-60137 — a SQL injection vulnerability in the `author__not_in` parameter of `WP_Query`, present from WordPress 6.8 onward.
CVE-2026-63030 — a REST API “batch-route confusion” vulnerability introduced in WordPress 6.9, affecting the batch endpoint used by the REST API.
On their own, neither flaw is catastrophic. Combined, they let an unauthenticated attacker turn a SQL injection into full remote code execution against WordPress Core.
Who’s affected
This is the part site owners actually need to know:
The complete, unauthenticated RCE chain affects WordPress 6.9.0 through 6.9.4, and WordPress 7.0.0 through 7.0.1.
Sites on the older 6.8.x branch aren’t exposed to the full RCE chain — only to the SQL injection half — because the REST API batch-route bug that turns it into RCE doesn’t exist before 6.9.<
WordPress shipped fixes in versions 6.8.6, 6.9.5, and 7.0.2.
Because the flaw lives in WordPress Core rather than in a theme or plugin, every site running an affected version is exposed regardless of what’s installed on top of it.
Why this one is different
Critical, no-login-required RCE bugs in WordPress Core itself are genuinely rare — most serious WordPress vulnerabilities live in third-party plugins and themes, not the core software. This is being treated as unusually urgent for a few reasons:
1. No preconditions. Most WordPress attacks need a vulnerable plugin, weak credentials, or a misconfiguration. This one works against a stock, out-of-the-box install.
2. Public exploit code. Public exploits have already been released for the vulnerabilities</cite>, and <cite index=”2-1″>early signs of in-the-wild exploitation were reported within 24 hours of disclosure.
3.WordPress took the unusual step of force-patching. WordPress force-pushed the update to all supported installations through its auto-update system — something the platform reserves for its most severe issues.
What you should do right now
1. Confirm your WordPress version. Log in to `wp-admin` and check the Dashboard, or ask your host/developer to confirm for you.
2. Update immediately to WordPress 7.0.2, 6.9.5, or 6.8.6, depending on your branch. Don’t assume the forced auto-update has already applied — verify it.
3. If you can’t patch right away, ask your host or developer about temporary mitigations, such as blocking unauthenticated access to the REST API batch endpoint at the firewall level. These are stop-gaps only, not substitutes for updating.
4. Check for signs of compromise if your site was running an affected version for any length of time after disclosure — unexpected admin accounts, unfamiliar files, or unusual outbound traffic are all worth a look.
The bigger picture
This isn’t really a story about one bug. It’s a reminder of something we tell every client: a website isn’t a “set and forget” asset. Core software, plugins, and themes all need to be kept current, monitored, and backed up — because when a flaw like this surfaces, the difference between “patched within hours” and “compromised within a day” often comes down to who’s paying attention.
If you are one of our clients and you’re not sure whether your site is affected, or you’d simply rather not have to think about WordPress security updates at 11pm on a Friday, that’s exactly what we’re here for. Get in touch with Southbank Creative and we’ll check your site’s status and make sure you’re protected.