Share Facebook Twitter LinkedIn Pinterest Email Copy Link WordPress patched wp2shell, a pre-authentication remote code execution chain in its core REST API, in an emergency 7.0.2 release on July 17, 2026, and pushed forced auto-updates to affected sites. Disclosed by Assetnote and Searchlight Cyber researcher Adam Kues, the chain pairs a REST batch-route confusion bug (CVE-2026-63030) with a core SQL injection (CVE-2026-60137) to reach code execution on a stock install with no login required. WordPress powers over 500 million sites, so exposure is enormous. What is wp2shell? wp2shell is a pre-authentication remote code execution chain in WordPress core, not in a plugin. It combines two separate flaws. The first, CVE-2026-63030, is a route-confusion bug in the REST API batch endpoint ( /wp-json/batch/v1 ) that functions as an authentication bypass. The second, CVE-2026-60137, is a critical SQL injection in the author__not_in parameter of WP_Query . On its own the SQL injection needs authentication. The batch-route bug removes that requirement, and the two together turn an anonymous request into full site compromise. Because the flaws live in core, a default WordPress install with no plugins is vulnerable. Which WordPress versions are affected? The RCE chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The SQL injection reaches back further, to the 6.8.x branch. WordPress released fixes across every supported branch and, given the severity, enabled forced updates through the auto-update system for sites running affected versions. WP2SHELL // AFFECTED vs FIXED VERSIONS CVE AFFECTED FIXED IN CVE-2026-63030 batch-route confusion (RCE) 6.9.0-6.9.4, 7.0.0-7.0.1 6.9.5, 7.0.2 CVE-2026-60137 WP_Query SQL injection 6.8.0-6.8.5, 6.9.x, 7.0.x 6.8.6, 6.9.5, 7.0.2 Not affected: WordPress prior to 6.8 | Forced auto-updates enabled How does the wp2shell exploit chain work? The attack is a chain, not a single silver bullet, and understanding the steps matters for detection. First, the batch-route confusion bug desynchronizes how the REST batch dispatcher maps requests to their permission checks, so an anonymous request is validated against the wrong handler and the authentication requirement falls away. That unlocks the SQL injection, which an attacker uses to dump the database. From the dump they lift the administrator password hash, crack it offline, and log in as admin. On a stock WordPress site, administrator access is effectively code execution: the built-in theme and plugin file editors let an admin write PHP, which is the final step to a web shell. WP2SHELL // PRE-AUTH RCE CHAIN 1. BATCH-ROUTE BUG CVE-2026-63030 = auth bypass → 2. SQL INJECTION CVE-2026-60137, now unauth → 3. DUMP DATABASE read admin hash ↓ 4. CRACK HASH recover admin password ← 5. LOG IN AS ADMIN full wp-admin access ← 6. WRITE PHP = RCE theme/plugin editor web shell NET RESULT Anonymous HTTP request to a stock WordPress site → server-side code execution. No plugins, no credentials, no user interaction required. Who found wp2shell, and how was it disclosed? The RCE chain was reported by Adam Kues, a researcher with Assetnote, part of Searchlight Cyber, who published the technical writeup and a public exposure checker at wp2shell.com . Kues, who posts as hashkitten (@hash_kitten), announced the disclosure on X, noting that the flaw can be exploited with no preconditions. WordPress core’s security team separately credited TF1T, dtro, and haongo for reporting the underlying SQL injection. This was a coordinated disclosure: technical details were held back at first to give defenders time to patch before proof-of-concept code circulated. Adam Kues, who posts as hashkitten (@hash_kitten), disclosing the wp2shell chain on X. Credit: @hash_kitten / Assetnote / Searchlight Cyber. Is wp2shell being exploited in the wild? Yes, early exploitation has been reported. Proof-of-concept material became public shortly after the patch, and monitoring vendors including PatchStack reported early in-the-wild activity against unpatched sites. That pattern is typical: once a core WordPress fix ships, attackers diff the patch to reconstruct the bug, and mass scanning follows within days. A pre-authentication chain that needs no plugins is exactly the kind of flaw that gets weaponized quickly by initial access brokers who resell footholds to ransomware crews. You can watch downstream victim listings on the Ransomtracker live feed . Update: a working wp2shell exploit is now public As of July 19, 2026, the risk has escalated sharply. A working exploit for wp2shell is now publicly available, matching Rapid7’s warning that a proof of concept would appear quickly once the patch shipped and the fix could be reverse engineered. The tool, published as Ultimate-wp2shell by a user going by codeb0ss, is hosted openly on GitHub under an MIT license with an “educational and authorized testing only” disclaimer, and is being mirrored and promoted through a Telegram channel...