Emergency Update: WordPress Patches Critical "wp2shell" Flaw Letting Anyone Hijack Sites

Vichitra Mohan
2 days ago
3 min read

WordPress has officially triggered an emergency security update after researchers uncovered a catastrophic vulnerability in its core system. The flaw allows completely anonymous, unauthenticated attackers to take full control of a default WordPress installation using just a single HTTP request.

Given that WordPress powers roughly 40% of the entire web, the security community is urging administrators to check their sites immediately. When a core remote code execution (RCE) bug hits a platform this large, hours matter far more than days.

Anatomy of the Vulnerability: What is "wp2shell"?

Dubbed "wp2shell" by the security researchers who discovered it, the flaw is tracked as CVE-2026-63030. It represents the most severe class of web vulnerabilities: an unauthenticated Remote Code Execution (RCE).

What makes this bug particularly dangerous is that it requires:

No user login or credentials
No special or custom configurations
No vulnerable third-party plugins

How It Works

The exploit achieves RCE by chaining together two distinct issues: a REST API batch request route confusion and a SQL injection. According to data released by Cloudflare, the vulnerability is actively exploitable on standard WordPress deployments "when a persistent object cache is not in use"—a condition that unfortunately applies to the vast majority of everyday WordPress websites.

Scope of the Threat

The vulnerability window stretches across several recent major versions, alongside a secondary, related security issue:

CVE-2026-63030 (Critical RCE): Affects WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. It is fully patched in versions 7.0.2 and 6.9.5.
CVE-2026-60137 (Less Severe SQLi): Affects versions from 6.8 onwards and is patched in 6.8.6.

Note: Legacy systems running versions prior to 6.8 are unaffected by either flaw.

The Open-Source Race Against Time

The WordPress security team actively coordinated with major infrastructure providers like Cloudflare ahead of the public release on July 17, 2026. This allowed Web Application Firewall (WAF) mitigations to go live just as the public announcement dropped.

However, open-source software presents a classic security paradox: the moment a security patch is published to protect defenders, the source code archive provides malicious actors with a literal roadmap to build an exploit. With millions of sites exposed, the gap between the patch release and manual site updates is a high-risk window.

How to Protect Your Site Immediately

WordPress.org has already deployed forced automatic updates for affected installations to mitigate the threat as quickly as possible. However, if your site operates in a version-controlled environment, has auto-updates disabled, or relies on strict deployment pipelines, you must act manually.

1.Check Your WordPress Version:Prerequisite.

Log into your WordPress dashboard and check your current version. If you are on the 6.9 or 7.0 branch, verify you have been upgraded to 6.9.5 or 7.0.2. If you are on 6.8, ensure you are on 6.8.6.

2.Apply the Core Security Update:Immediate Action.

If your site hasn't auto-updated, manually trigger the core update through the Dashboard > Updates panel immediately, or deploy the patched version via your standard CI/CD workflow.

3.Implement WAF Blocks (If Unable to Patch):Temporary Mitigation.

If you cannot patch the site code immediately, you must block the exploit vectors at your firewall level. Ensure your WAF blocks both the pretty permalink path /wp-json/batch/v1 and the query-string format ?rest_route=/batch/v1. Blocking only one leaves the alternate route wide open to attackers.