WordPress WP2Shell Vulnerability: Update Immediately

If you manage a WordPress site, chances are you have heard about "WP2Shell" over the past few weeks. This flaw, disclosed in July 2026, does not concern an obscure plugin or poorly coded theme: it touches the very core of WordPress. Here is what you need to know, and why proactive monitoring of your updates is more essential than ever.

What is WP2Shell?

WP2Shell is not a single flaw, but two distinct vulnerabilities that security researchers managed to chain together:

• CVE-2026-63030: a routing flaw in WordPress's REST API batch processing endpoint (/wp-json/batch/v1).
• CVE-2026-60137: a SQL injection also present in the WordPress core.

Combined, these two flaws allow an attacker, without any account or credentials, to gain full control of a WordPress site running default dependencies. No vulnerable plugin required, no special configuration needed: a plain site is enough.

The nickname "WP2Shell" sums up the problem well: with a few well-crafted requests, a stranger can transform a standard WordPress installation into a gateway to drop a malicious shell and execute arbitrary code on the server.

An AI-assisted discovery

A notable detail in this case: the flaw was not found by manually sifting through thousands of lines of code. The researchers at Searchlight Cyber behind the discovery used an artificial intelligence model to analyze WordPress source code and identify the chain of vulnerabilities. It is a sign of the times: vulnerability research increasingly relies on AI to explore large codebases and spot chains of bugs that a traditional human audit might take much longer to detect.

The cost-to-impact ratio is staggering: the researcher behind the discovery estimates spending roughly 25 dollars in AI tokens to find this chain of flaws over about ten hours of work. Meanwhile, this type of vulnerability - pre-authentication remote code execution on WordPress - typically fetches up to $500,000 on the exploit broker market. Twenty-five dollars of compute against half a million dollars in potential value: the gap shows how fast this kind of research is becoming accessible.

Which sites are affected?

The affected versions are:

• WordPress 6.9.0 to 6.9.4
• WordPress 7.0.0 to 7.0.1

Given that WordPress powers a substantial share of websites globally (~40% in 2026), the potential scope of this vulnerability is huge. We are talking about tens, if not hundreds of millions of affected installations.

Maximum severity, almost immediate exploitation

This vulnerability was assigned a severity score near the absolute maximum. Worse still: active exploitation began almost immediately following public disclosure. In just a few days, dozens of automated exploit tools circulated, and US cybersecurity authorities (CISA) added both CVEs to their Known Exploited Vulnerabilities catalog.

Studies conducted at the time showed that a majority of organizations running WordPress had at least one vulnerable instance at the time of disclosure, and that a significant portion of these vulnerable sites were directly exposed to the Internet, well within reach of attackers.

The role of hosting providers: a safety net for part of the web

An important aspect of this crisis deserves highlighting: not all WordPress sites were exposed in the same way. Several major hosts and infrastructure providers, including Automattic, Bluehost, Cloudflare, GoDaddy, Hostinger, and WP Engine, received early access to information about 24 hours prior to public disclosure via a private channel under strict confidentiality rules. This allowed them to prepare and deploy patches or Web Application Firewall rules as soon as the official announcement was made, sometimes before site owners were even aware of the issue.

Combined with the forced automatic updates system triggered by WordPress.org, this safety net significantly reduced the exposure window for a large portion of sites hosted with these providers. However, this protection was not universal: sites with automatic updates disabled, those deployed via custom pipelines that bypass native updates, or those hosted with smaller providers who did not receive early access remained fully exposed. Hence the importance of checking your installed version yourself rather than assuming "someone else took care of it."

Timeline of the crisis

• July 16, 2026: about 24 hours before public disclosure, several major hosts and infrastructure providers receive early access to information.
• July 17: public disclosure of the vulnerability and simultaneous release of the patch (WordPress 6.9.5 and 7.0.2). WordPress and informed partners deploy a forced automatic update for affected sites, underscoring the severity of the situation.
• July 19: over twenty public proofs of concept (PoCs) documented, just two days after disclosure.
• July 21: both vulnerabilities are added to CISA's Known Exploited Vulnerabilities catalog.
• July 22: full technical details of the exploit chain are published, further accelerating the spread of attack tools.

This timeline illustrates a reality we observe increasingly often: the time between the disclosure of a critical flaw and its mass exploitation is now measured in hours, not weeks.

What to do if you are affected?

1. Check your WordPress version immediately on your site.
2. Update to version 6.9.5, 7.0.2, or later.
3. If an immediate update is not possible, a temporary workaround is to block anonymous access to the affected endpoint at your Web Application Firewall level.
4. Inspect your site for signs of compromise prior to the update: unknown admin accounts, suspicious files, or plugins you did not install. Automated tools are also available to check for major indicators.

Why proactive management changes everything

The WP2Shell incident perfectly illustrates why waiting to "remember to update" is no longer a viable strategy. When a critical flaw affects the WordPress core and is exploited at scale within days of disclosure, every hour without a patch counts.

Sources

• WordPress.org, Version 7.0.2 - Release Notes and WordPress 7.0.2 Release - WordPress News
• Searchlight Cyber, Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25

Automatically translated by AI.