wp2shell CVE-2026-63030: The WordPress RCE Putting 500+ Million Sites at Risk

What it is

wp2shell is a WordPress core chain of two individually moderate bugs, disclosed July 17, 2026. Searchlight Cyber found them. CVE-2026-63030 is a route confusion in the REST batch endpoint (CVSS 7.5 alone). CVE-2026-60137 is a SQL injection in WP_Query. Chained, they give an anonymous attacker admin password hashes and, per the page, code execution on a default install with no plugins.

How it works

• The /wp-json/batch/v1 endpoint has existed since WordPress 5.6. The route confusion was introduced in 6.9 and misroutes attacker-controlled input to the wrong internal handler.
• The SQL injection sits in the author__not_in parameter of WP_Query and has existed since 6.8. Alone, it needed more direct access to reach.
• The attacker sends a request to the batch endpoint and smuggles a malicious author__not_in into a WP_Query call. A public PoC on GitHub dumps the user table, including admin hashes, and reaches code execution.
• The RCE path needs the 6.9 route confusion. That is why 6.8.x has the SQL injection only.

Preconditions / Affected

• Full chain: 6.9.0-6.9.4 and 7.0.0-7.0.1.
• SQL injection only: 6.8.0-6.8.5.
• Fixed in 6.9.5, 7.0.2 and 6.8.6.
• No login, plugin or special configuration is needed.

What to do

1. Confirm the version under Dashboard → Updates. WordPress force-pushed the update, but the page says to verify anyway. Hosts that disable auto-updates at server level, or management setups that override core update behavior, may not have applied it.
2. If you can't patch yet, use these stopgaps (Searchlight Cyber's recommendation): - Install a plugin that blocks anonymous REST API access. - Block both /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF. The query-string form is a second route to the same endpoint, so blocking only the pretty URL leaves a gap.
3. If the site ran an affected version at any point before patching: - Rotate all administrator passwords. - Look for unfamiliar admin accounts, unexpected plugin installs, theme edits or new files. - Search access logs for requests to either batch URL around the disclosure window. - Treat any finding as a confirmed compromise and run full incident response. Don't just remove the suspicious item.

Caveats

• The page says no in-the-wild exploitation was confirmed as of its reporting, but a full public PoC appeared within roughly 24-48 hours of disclosure.
• The stopgaps may break legitimate site functionality and don't replace patching.
• The page names Cloudflare WAF protections shipped alongside the patches, but gives no detail on what they cover.
• The page gives no log signatures beyond the two request paths.