July 27, 2026
wp2shell Technical Analysis
wp2shell(WP2SHELL) — the name given to a critical WordPress vulnerability disclosed in July 2026.
By Olubusayo Alamu
1 min read
WordPress: is a free, open-source Content Management System (CMS) that allows to build and manage a website without needing to write code.
wp2shell is a pre-authentication remote code execution (RCE) vulnerability chain in WordPress core, tracked as CVE-2026–63030 combined with CVE-2026–60137. It affects word press core. It has a CVSS score of 9.8 (critical) assigned by Searchlight Cyber (the researchers that discovered it). The exploit chain itself — 9.8.
The individual CVEs carry 7.5 and 9.1 respectively in NVD-style scoring, but the practical impact — the chained wp2shell exploit — is widely rated 9.8 Critical, since it results in full unauthenticated remote code execution on a default WordPress install.
WordPress is one of the most widely deployed content management systems, making vulnerabilities in its core software potentially significant for organizations operating public-facing websites. The vulnerability allows an unauthenticated attacker to execute code via the WordPress REST API batch endpoint, potentially resulting in complete compromise of the website and its underlying data. No valid account or user interaction is required.
The vulnerability affects WordPress versions 6.9.0-6.9.4 and versions 7.0.0-7.0.1. It does not affect any version less than or equal to 6.85(<= 6.8.5). The issue is fixed in WordPress 6.9.5, 7.0.2 and WordPress 7.1 Beta 2.
Cloudflare reported that the vulnerable code path can be reached when a persistent object cache is not in use while Searchlight Cyber stated that it can be exploited remotely against a default WordPress installation without requiring additional plugins.
POC
i. Sends crafted requests to the WordPress REST API batch endpoint.
ii. Exploits a route confusion flaw to bypass intended request handling.
iii. It reaches a vulnerable SQL injection in WordPress core.
iv. The chain ultimately demonstrates that an attacker could gain code execution on vulnerable, unpatched installations.
Remediation: to update WordPress to version 7.0.2, or 6.9.5 if one is on the 6.9 branch. as soon as possible. If not possible, temporarily protect your instance by blocking anonymous access to the batch API.
How to block anonymous access to the batch API;
a. Installing a plugin that blocks anonymous access to the rest API entirely.
or
b. Blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 at a WAF level.