I Broke Down wp2shell — the RCE Bug Putting 500M WordPress Sites at Risk

A new critical vulnerability called wp2shell has changed the threat model for over 500 million WordPress websites. No login. No plugin. No user interaction required. Just one crafted request to WordPress Core, and an attacker can walk away with admin access and full remote code execution.

Here's what's actually happening:

• Two chained CVEs (CVE-2026–63030 and CVE-2026–60137) turn an unauthenticated REST API request into a direct path to the WordPress database
• The vulnerability lives in WordPress Core itself — not a theme, not a plugin
• WordPress force-pushed emergency patches (7.0.2, 6.9.5, and 6.8.6) because the risk was too high to wait for manual updates
• Security researchers are already reporting proof-of-concept exploits circulating and early signs of in-the-wild exploitation within 24 hours of disclosure

If you manage even one WordPress site, this is worth five minutes of your day.

In the full breakdown, I walk through exactly how the exploit chain works step by step, which WordPress versions are affected, real indicators of compromise to check your server logs for, and the exact patch, WAF, and credential-rotation commands to run today.

👉 Read the complete technical breakdown here: https://www.xpert4cyber.com/2026/07/wp2shell-wordpress-rce-vulnerability.html