wp2shell: The Devastating WordPress Vulnerability That Threatens Millions of Websites
A critical security vulnerability, colloquially named “wp2shell,” has been disclosed, targeting the very foundation of the world’s most popular Content Management System. This pre-authentication Remote Code Execution (RCE) flaw is particularly alarming because it affects “stock” WordPress installations—meaning a site is vulnerable even with zero third-party plugins installed. With WordPress powering over 500 million websites, the potential blast radius is immense.
From a technical standpoint, this is not a single-point failure but rather a sophisticated exploit chain. The vulnerability leverages a logical confusion within the WordPress REST API batch routing mechanism. By manipulating batch requests, an attacker can trigger a secondary SQL injection flaw, ultimately bypassing security boundaries to execute arbitrary code on the underlying server.
Technical Breakdown of the Vulnerabilities
The disclosure involves two distinct but interconnected vulnerabilities identified by the security community:
- CVE-2026-63030 (GHSA-ff9f-jf42-662q): Discovered by researcher Adam Kues of Assetnote, this is the primary RCE vector. It allows an unauthenticated attacker to gain full system control.
- CVE-2026-60137 (GHSA-fpp7-x2x2-2mjf): A related SQL injection flaw reported by researchers TF1T, dtro, and haongo, which acts as a critical component in the exploitation chain.
Because these flaws require no prior credentials or specific site configurations, they present a “zero-click” style risk for anonymous internet users. To prevent widespread exploitation while users prepare to patch, Searchlight Cyber has withheld specific exploit payloads but has provided a public scanning tool at wp2shell[.]com to help administrators assess their risk profile.
Affected Version Matrix
Administrators should immediately audit their running versions against the following list:
- WordPress ≤ 6.8.5: Not susceptible to the full RCE chain (though 6.8.x remains vulnerable to the SQL injection CVE-2026-60137).
- WordPress 6.9.0 – 6.9.4: Fully vulnerable to both RCE and SQL injection.
- WordPress 7.0.0 – 7.0.1: Fully vulnerable to both RCE and SQL injection.
- WordPress 7.1 Beta: Vulnerable; security fixes were integrated in 7.1 beta2.
Remediation and Emergency Mitigation
The WordPress security team has released critical patches to neutralize these threats. Version 7.0.2 addresses both the critical RCE and the high-severity SQL injection. For those on older maintenance branches, backport releases 6.9.5 and 6.8.6 are also available.
Given the severity, WordPress has enabled forced auto-updates for many installations. However, for enterprise environments or managed hosting, we strongly recommend manual verification of the update status via the WordPress Dashboard under Updates → Update Now.
Emergency Stopgap Measures:
If your environment cannot be patched immediately, you can implement the following temporary mitigations via your Web Application Firewall (WAF) or server configuration:
- Restrict REST API Access: Use a security plugin to disable anonymous/unauthenticated access to the REST API.
- WAF Pattern Matching: Implement rules to block all requests to the following endpoints:
/wp-json/batch/v1?rest_route=/batch/v1
Warning: These mitigations are temporary and may break legitimate site functionality (such as block editor features or third-party integrations) that rely on the REST API. Prioritize a full core update as your primary defense.