Published: Wed 22 July 2026
Prepared by: Adam Skupien, Vulnerability Security Analyst
WordPress has disclosed a critical remote code execution (RCE) vulnerability chain in WordPress Core - dubbed "wp2shell" - affecting sites running WordPress 6.9.x and 7.0.x. Unlike most WordPress-related incidents, this issue requires no plugin, no theme, and no authentication: a single crafted HTTP request against a stock install is sufficient.
Multiple security firms have confirmed active in-the-wild exploitation, including credential exfiltration and webshell deployment, within days of the 17 July 2026 disclosure. Public proof-of-concept exploit code is circulating. CISA has added both associated CVEs to its Known Exploited Vulnerabilities (KEV) catalogue.
Patches are available now (WordPress 7.0.2 / 6.9.5 / 6.8.6). WordPress.org has enabled forced automatic updates for affected sites, but administrators should verify the update actually completed rather than assume it has.
WP_REST_Server::serve_batch_request_v1(), chained with an SQL injection (CWE-89) in the author__not_in parameter of WP_Query.Affected Systems:
WordPress Core (self-hosted and hosted installations running an affected version).
| Version | Affected | Fixed |
|---|---|---|
| WordPress 7.0.x | 7.0.0 – 7.0.1 (full RCE chain) | >= 7.0.2 |
| WordPress 6.9.x | 6.9.0 – 6.9.4 (full RCE chain) | >= 6.9.5 |
| WordPress 6.8.x | 6.8.0 – 6.8.5 (SQL injection component only — not chainable to RCE on this branch) | >= 6.8.6 |
| WordPress 7.1 (beta) | beta1 (both vulnerabilities) | beta2 |
| WordPress < 6.8.0 | Not affected | N/A |
Note: this is a Core-level issue, not a plugin or theme vulnerability — patch status cannot be resolved by disabling or updating third-party add-ons.
Successful exploitation gives an unauthenticated attacker full control of the affected website: arbitrary PHP code execution, complete database read/write access (including credentials and authentication keys), and the ability to install persistent webshells, rogue plugins, or unauthorised administrator accounts. Because the vulnerable REST API endpoint is enabled by default and WordPress powers a very large proportion of public-facing websites, risk is highest for any internet-facing site on an affected version that has not yet applied the 17 July 2026 security release.
Immediate mitigations (if patching cannot occur right away):
wp core version (WP-CLI)./wp-json/batch/v1 and ?rest_route=/batch/v1.Patching:
Review web server / WAF logs for POST requests to /wp-json/batch/v1 or ?rest_route=/batch/v1 containing nested batch requests with SQL-like strings (e.g. SELECT, UNION, SLEEP) in author_exclude / author__not_in parameters. HTTP 207/200 multi-status responses to batch endpoint requests have been flagged by Wiz Research as a high-fidelity exploitation signal. Run wp core verify-checksums against any previously unpatched instance to identify unauthorised core file changes, and check for newly created administrator accounts, unexpected PHP files under wp-content/uploads or wp-content/plugins, unfamiliar scheduled tasks, and unexplained outbound connections. Preserve web, WAF, hosting, and authentication logs before any cleanup activity in case forensic investigation is required.
MDR customers: Triskele Labs will continue tuning detections for behaviours consistent with the exploitation of CVE-2026-63030 and CVE-2026-60137 across supported log sources.
Vulnerability Management customers: Environments will be assessed for vulnerable WordPress Core versions and internet exposure; any findings will be communicated through priority channels.