Since 17 July 2026, a critical vulnerability in the WordPress core has been causing concern amongst website operators. Known as ‘wp2shell’, it allows unauthenticated attackers to remotely execute code on a standard installation – without the need for a plugin or a login. The vulnerability is already being actively exploited, and the affected CVEs are now on CISA’s KEV list. We explain what wp2shell is, who it affects and what to do now.
What is wp2shell?
Security researchers at Searchlight Cyber (Assetnote team) have discovered a chain of two vulnerabilities in the WordPress core which, when combined, enable a complete takeover of a website. The entry point lies in the batch endpoint of the REST API (/wp-json/batch/v1). There, incoming requests are validated in two separate loops and then executed – a logical flaw that can be exploited to cause a path misdirection.
This method can first be used to trigger an SQL injection (CVE-2026-60137), which can, for example, be used to retrieve the password hash of an administrator account. Subsequently, the actual logic flaw in the batch processor (CVE-2026-63030) leads to code execution. Taken together, this results in full, unauthenticated remote code execution – in short: complete control over the server.
Particularly critical: the attack works on a standard installation without any additional plugins and without any prerequisites. All that is required is an accessible WordPress server running a vulnerable version.
Which versions are affected?
The full RCE chain affects WordPress versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. The 6.8 branch is only affected by the SQL injection component (CVE-2026-60137), not by the full RCE chain. The WordPress project has patched the vulnerabilities in versions 6.9.5, 7.0.2 and 6.8.6; a fix is also included in 7.1 Beta 2.
Due to the severity of the issue, the WordPress.org team has taken the unusual step of triggering forced automatic updates for affected installations worldwide. However, this does not mean that every site is automatically protected; administrators should check the installed version themselves and not rely solely on the auto-update mechanism.
Secure
7.0.2, 6.9.5, 6.8.6 or later
Partially affected
6.8.x prior to 6.8.6 (SQL injection only)
Fully vulnerable
6.9.0 to 6.9.4, 7.0.0 to 7.0.1
Why is wp2shell so dangerous?
A few days after its disclosure, Searchlight Cyber published the full technical details of the attack chain; since then, several public proof-of-concept exploits have been circulating. Security firms such as Wiz, Patchstack and Hexastrike all report active exploitation in the wild. Both CVEs were added to CISA’s KEV (Known Exploited Vulnerabilities) catalogue on 21 July 2026, a clear indication of ongoing, confirmed attacks.
Observed attacks range from automated mass scanning of vulnerable installations, through the extraction and cracking of admin password hashes, to the installation of persistent webshells and malicious plugins. This allows attackers not only to gain one-off access, but also to establish a permanent backdoor into the affected infrastructure.
A special case observed by Cloudflare: the vulnerable code path in CVE-2026-63030 is primarily accessible when no persistent object cache is in use. Whilst this reduces the risk in some setups, it is by no means a substitute for applying the patches.
How to check if you are affected
Check the version
Check the exact core version for each WordPress instance in the admin dashboard or via WP-CLI – do not just check a single site at random.
Search logs for anomalies
A conspicuously high number of HTTP 207 or 200 multi-status responses to requests to the batch endpoint is considered a fairly reliable indication of a successful exploit attempt.
Check User-Agent strings
Access attempts with suspicious identifiers such as “wp2shell” or “rezwp2shell” in the User-Agent field indicate the use of purpose-built attack frameworks.
Search for unknown admin accounts and plugins
Check whether any new administrator accounts, unknown plugins or modified files have appeared since 17 July – these may be signs of a previous compromise attempt.
Mint Secure GmbH
How Mint Secure supports you
You’re not sure exactly how many WordPress installations are running in your organisation, let alone which version they’re using? That’s exactly where we come in.
Instant check
We carry out targeted scans of your WordPress instances for wp2shell and other known vulnerabilities, and provide you with a prioritised list of actions to take.
Incident Response
If there’s a suspicion that a compromise has already occurred, we’ll assist with analysing, containing and remediating your systems.
Vulnerability Management
Using a structured vulnerability management process, we ensure that critical patches such as this one are rolled out reliably and quickly in future.
Would you like to know if your WordPress sites are affected? We offer a free initial consultation. Get in touch.
Conclusion
wp2shell is one of the most critical WordPress vulnerabilities of recent years: pre-authenticated, no plugin required, no prerequisites, and confirmed to be actively exploited.
Anyone operating WordPress should check their installed version immediately and, if necessary, manually update to 7.0.2, 6.9.5 or 6.8.6, rather than relying solely on forced auto-updates.
It is also worth checking the logs: suspicious batch requests, unknown admin accounts or new plugins may be indications that a breach has already occurred.
Mint Secure can help you audit your WordPress environment, respond in the event of an incident and establish a long-term Vulnerability Management strategy. Talk to us.
