WordPress has patched a critical unauthenticated remote code execution chain in core that security researchers say is the first of its kind in nearly a decade. The issue, widely referred to as wp2shell, combines two flaws that can be chained together without a vulnerable plugin, theme, or login session.
WordPress Core flaw leads to unauthenticated RCE
On Friday, July 17, 2026, the WordPress Security Team released updates for WordPress Core after two vulnerabilities were found to work together in a way that could allow remote code execution. The chain was discovered and reported by Adam Kues of Assetnote / Searchlight Cyber, and the disclosure was met with same-day mitigation steps from security vendors.
WordPress shipped patched versions 6.8.6, 6.9.5, and 7.0.2 on the same day. In its release notes, WordPress described the update as fixing one critical and one high-severity security issue, and said forced automatic updates were enabled for affected versions because of the seriousness of the problem.
Why wp2shell is drawing so much attention
The reason wp2shell stands out is simple: it affects WordPress Core itself. An attacker does not need a vulnerable add-on, a compromised theme, or any authenticated access to begin abusing the flaw. A public-facing WordPress installation running an affected version is enough to present risk.
The chain is tracked as CVE-2026-60137 and CVE-2026-63030. The first issue is an unauthenticated SQL injection involving the author__not_in query parameter. The second is a REST API batch request route-confusion issue that can be chained with the SQL injection to reach remote code execution.
How the chain works at a high level
According to the technical description referenced in the source material, the batch API validation and execution paths could become desynchronized. That mismatch can let attacker-controlled parameters reach a route that would normally sanitize them. From there, the SQL injection can be used in a longer sequence involving WordPress post caching, oEmbed cache rows, changesets, and action hooks.
The end result, in practical terms, is severe: an attacker may be able to create an administrator account and then execute code through normal administrator functionality, such as uploading a plugin. That can translate into full control of the site and code execution with the web server’s privileges.
Which WordPress versions are affected
The affected versions vary slightly depending on the flaw:
- WordPress 6.9.x is affected by both vulnerabilities and is patched in 6.9.5.
- WordPress 7.0.x is affected by both vulnerabilities and is patched in 7.0.2.
- WordPress 6.8.x is affected by the SQL injection vulnerability and is patched in 6.8.6.
- WordPress versions prior to 6.8 are not affected, according to the source material.
Because 6.8.x is not exposed to the REST API batch route-confusion issue, it is not subject to the full remote code execution chain. It still needs to be updated promptly to address the SQL injection.
Timeline shows exploit activity began quickly
The timeline around disclosure suggests attackers moved fast. WordPress released the fixes and Wordfence published its initial advisory on July 17, 2026. Wordfence also rolled out firewall protection that same day for Premium, Care, and Response customers.
Wordfence’s telemetry then showed early probing within hours of disclosure. At 23:29 UTC on July 17, 2026, it observed exploit-shaped probing against the REST API batch endpoint. By 23:42 UTC, it saw a clear SQL injection attempt aimed at the vulnerable author exclusion behavior through the batch endpoint.
Over July 18–19, 2026, researchers were already reverse engineering the patch, while proof-of-concept exploit code and independent reproductions began circulating. On July 20, 2026, Searchlight Cyber published Adam Kues’ detailed technical writeup, along with a public checker at wp2shell.com.
What Wordfence saw in attack data
Wordfence said the attack data tied to its wp2shell firewall rule showed more than simple endpoint scanning. It observed requests trying to exercise the batch route-confusion behavior and, soon after, requests attempting SQL injection.
The company said its own testing later confirmed that the SQL injection is central to the full remote code execution chain. That detail matters because it helps explain why the issue is not just a narrow bug in an API route, but a path that can lead to deep compromise.
What Wordfence customers should know
Wordfence Premium, Care, and Response customers received firewall protection on July 17, 2026, the same day the WordPress patches were released. Wordfence Free users are scheduled to receive the same protection on August 16, 2026, following the standard 30-day delay.
Even so, the advice remains unchanged: a firewall is a layer of defense, not a substitute for patching WordPress Core. Security rules can reduce exposure, but the only durable fix is to move to a patched release.
What site owners should do now
If you manage a WordPress site, the immediate steps are straightforward:
- Confirm your current WordPress Core version.
- Update to 6.8.6, 6.9.5, or 7.0.2 depending on your branch.
- Treat 6.9.x and 7.0.x as especially urgent because they are affected by the full chain.
- Verify that automatic updates completed successfully.
- Review administrator accounts for anything unexpected.
- Check recent plugin uploads and file changes.
- Use the public checker at wp2shell.com.
- If you use Wordfence, review firewall logs for blocked requests to
/wp-json/batch/v1or?rest_route=/batch/v1.
Any sign of exploitation should be treated seriously. Because the chain can lead to administrator creation and code execution, a suspected incident may amount to a full site compromise.
A reminder that patching still matters most
wp2shell is unusual not just because it is severe, but because it broadens the attack surface at the core platform level rather than through third-party software. That combination of unauthenticated reachability, no plugin or theme requirement, a large installed base, and public proof-of-concept activity makes it especially concerning.
WordPress moved quickly, and security vendors responded on the same day. But with exploitation attempts beginning within hours, the practical message for site owners is clear: confirm you are patched now, and do not rely on protection layers alone.
Explore more: Blog Our Services Contact Us
Source: Original report
Was this helpful?
Last Modified: August 10, 2026 at 4:52 pm
2 views
