Wordfence says a newly patched WordPress core vulnerability chain, dubbed WP2Shell, has already been hit by more than 11 million blocked exploit attempts, with attackers trying to turn unauthenticated access into administrator-level control and then into code execution. The company’s analysis ties the campaign to two flaws in WordPress core that were disclosed and fixed on July 17, 2026.
What WP2Shell is and why it matters
The issue is not a single bug but a chain. Wordfence says attackers can combine an unauthenticated SQL injection flaw tracked as CVE-2026-60137 with a REST API batch request route confusion issue, CVE-2026-63030, to create an administrator account without logging in. Once an attacker has admin access, they can use normal WordPress features such as plugin upload to execute code on the server.
That makes the chain especially serious. In WordPress, an administrator account is effectively a master key, so compromise at that level can expose content, credentials, and site configuration, and can allow persistence through malicious plugins or themes.
Which WordPress versions were affected
According to Wordfence’s summary, the SQL injection flaw affected WordPress core versions 6.8 through 6.8.5, 6.9 through 6.9.4, and 7.0 through 7.0.1. The batch request route confusion issue applied only to the latter two ranges, meaning WordPress 6.9 through 7.0.1.
The patched versions listed by Wordfence are:
- WordPress 6.8.6
- WordPress 6.9.5
- WordPress 7.0.2
Wordfence also noted that the WordPress Security Team issued forced automatic updates, which likely reduced the number of sites still exposed after disclosure.
How the WordPress core flaws work
CVE-2026-60137: SQL injection via author__not_in
Wordfence describes CVE-2026-60137 as a generic SQL injection vulnerability tied to the author__not_in parameter. The problem stems from insufficient escaping of user-supplied input and inadequate preparation of an existing SQL query, allowing an unauthenticated attacker to append additional SQL into a query already being executed.
In practical terms, that can be used to extract sensitive database information and help prepare the second stage of the attack chain.
CVE-2026-63030: REST API batch request route confusion
The second flaw, CVE-2026-63030, affects the REST API batch request endpoint at /wp-json/batch/v1. Wordfence says it is caused by a route and validation desynchronization that can let a validated sub-request be dispatched to an unintended callback, bypassing the allow_batch restriction and sidestepping the target route’s input sanitization.
That behavior can be chained with the SQL injection flaw, making it possible for attackers to reach actions that should not be available to unauthenticated users.
What attackers are doing in the wild
Wordfence says its customers protected by the premium firewall rule have already seen real-world exploitation attempts. In the observed attacks, threat actors used the batch endpoint to trigger requests that included a SQL injection payload and then attempted to create a new user with the administrator role.
The example payload in Wordfence’s report shows nested batch requests that touch endpoints such as /wp/v2/widgets, /wp/v2/posts, and /wp/v2/users, with repeated attempts to create a user named wpenginebot with administrator privileges.
Wordfence says attackers began targeting sites on July 17, 2026, the same day the vulnerability was disclosed, with a smaller number of probes on day one and a much larger wave of attempts on July 18.
Attack volume and the firewall response
Wordfence reports that its firewall has blocked more than 11 million exploit attempts tied to this chain. The company notes that this figure reflects only customers protected by the premium firewall rule, which represents a small portion of its overall user base.
That detail matters because the number of blocked requests does not automatically mean a matching number of successful compromises. Wordfence says the affected versions were relatively limited, and the forced update campaign likely protected many sites before attackers could get far.
Its product rollout also differed by subscription level:
- Wordfence Premium, Care, and Response users received firewall protection on July 17, 2026.
- Users on the free version of Wordfence are scheduled to receive the same protection on August 16, 2026.
Indicators site owners should check
Wordfence recommends reviewing WordPress users for unknown administrator accounts, especially accounts created on or after July 17, 2026. It cautions that attackers who succeed in logging in as an administrator may be able to cover their tracks.
The company also advises checking logs for requests to /wp-json/batch/v1, particularly from these IP addresses it identified as the most active offenders:
- 103.215.74.26
- 103.215.75.66
- 103.215.75.19
- 103.168.67.253
- 51.195.39.149
- 103.168.66.101
- 51.195.39.150
- 140.174.186.101
- 45.148.10.18
- 45.148.10.247
Wordfence adds that the absence of those log entries does not prove a site was never compromised.
Why the incident is notable
Wordfence characterizes the event as one of the most important WordPress core vulnerabilities in years and says it is the first critical unauthenticated remote code execution issue in WordPress core in nearly a decade. It also credits a strong response from the WordPress Security Team, hosting providers, and the broader security ecosystem for limiting the damage.
The company points to the combination of AI-assisted research, rapid disclosure, coordinated firewall coverage, and forced patching as factors that helped prevent a wider disaster. Even so, Wordfence is urging administrators to verify that their sites are running a patched WordPress release rather than assuming automatic updates have already taken care of everything.
Explore more: Blog Our Services Contact Us
Source: Original report
Was this helpful?
Last Modified: August 10, 2026 at 4:47 pm
0 views
