wp2shell: Critical WordPress Security Vulnerability Threatens 500 Million Websites

In mid-July 2026, wp2shell — one of the most critical security vulnerabilities of recent years — became public in the WordPress core. The flaw allows attackers to execute arbitrary code on a WordPress installation completely without credentials and without any installed plugins. Since WordPress powers an estimated 40% of all websites worldwide, potentially over 500 million sites are affected.

What is wp2shell?

wp2shell isn't a single vulnerability, but the combination of two bugs into a so-called pre-authentication remote code execution (RCE): an SQL injection in the author__not_in parameter of WP_Query (CVE-2026-60137) meets a route confusion in the REST API batch route /wp-json/batch/v1 (CVE-2026-63030). Only the interplay of both bugs makes the attack possible.

How does the attack work?

The REST API batch route normally allows bundling multiple API calls into a single request. Due to the route confusion, this feature can be abused to trigger internal WP_Query calls with manipulated parameters. Through the vulnerable author__not_in parameter, an attacker injects their own SQL code and can ultimately execute arbitrary PHP code on the server — completely without login and without any user interaction.

Which versions are affected?

• WordPress 6.9.0 to 6.9.4 — affected, fixed in 6.9.5

• WordPress 7.0.0 to 7.0.1 — affected, fixed in 7.0.2

The bug is in the WordPress core itself, not in a plugin or theme. A standard install without any extensions is already vulnerable.

Is the vulnerability already being actively exploited?

Yes. Security firms such as Patchstack report active attacks in the wild. In addition, a working proof of concept is publicly available on GitHub, further lowering the barrier to entry for attackers.

What you should do now

• Update WordPress immediately to 7.0.2 or 6.9.5

• If an update isn't possible in the short term: block anonymous access to /wp-json/batch/v1 or ?rest_route=/batch/v1 via WAF

• Alternatively, use a plugin that blocks anonymous access to the REST API in general

• Check server and access logs for unusual requests to the batch API

Conclusion

wp2shell impressively demonstrates how dangerous vulnerabilities in the WordPress core itself can be — regardless of plugins or themes. Anyone running WordPress should immediately check whether their version is affected and not delay the update. The longer a vulnerable installation stays online, the greater the risk of compromise.