wp2shell is an unauthenticated remote code execution (RCE) chain disclosed on July 17, 2026, by the WordPress security team. It marks the first critical unauthenticated RCE in the WordPress core in nearly a decade. The chain was discovered and reported by Adam Kues of Assetnote / Searchlight Cyber.

The vulnerability chain consists of two CVEs:

• CVE-2026-60137: An unauthenticated SQL injection via the author__not_in query parameter.
• CVE-2026-63030: A REST API batch request routing confusion bug that can be chained with the SQL injection to achieve RCE.

Severity

This vulnerability requires no plugins, themes, or login credentials—it only needs the target WordPress site to be publicly accessible. Attackers can exploit the chain to create admin accounts and then upload plugins or other means to execute arbitrary code on the server, gaining full administrative control over the site.

Affected Versions

Affected Versions

Version Branch	Affected?	Fixed Version
WordPress 7.0.x	Both vulnerabilities present	7.0.2
WordPress 6.9.x	Both vulnerabilities present	6.9.5
WordPress 6.8.x	Only the SQL injection (not the full RCE chain)	6.8.6
WordPress < 6.8	Not affected	—

Timeline of Events

• July 17: WordPress released security updates. Wordfence pushed firewall protections to paying customers the same day.
• July 17, 23:29 UTC: First observed probing traffic against the REST API batch endpoint.
• July 17, 23:42 UTC: First observed SQL injection attempts.
• July 18–19: Researchers began reverse‑engineering the patches; proof‑of‑concept exploit code started circulating.
• July 20: The discoverer published a detailed technical write‑up and a public detection tool at wp2shell.com.

Attacks were observed within hours of the disclosure, and the risk escalated sharply after the PoC became public.

Recommendations for Site Owners

The article urges all WordPress site owners to take these steps immediately:

1. Confirm your current WordPress core version.
2. Update immediately to 6.8.6, 6.9.5, or 7.0.2 (depending on your current branch).
3. Users on 6.9.x and 7.0.x are especially urgent, as they are affected by the full RCE chain.
4. Verify that automatic updates have completed successfully.
5. Check for any unexpected new admin accounts.
6. Look for recent plugin uploads and file changes.
7. Use wp2shell.com to test if your site is still vulnerable.
8. If you have Wordfence, review the firewall logs for blocks against /wp-json/batch/v1.

wp2shell is one of the most severe WordPress core security incidents in recent years. It is unauthenticated, requires no plugins or themes, has a wide attack surface, and can lead to full site compromise. Although the WordPress team patched it quickly, and Wordfence provided protection for paid users on the same day, attack activity began within hours. Firewall rules can only reduce the risk; installing the official patch is the only complete fix.