WP2Shell: The WordPress Core Bug Hackers Are Already Exploiting

If your website runs on WordPress, there is a very good chance it was vulnerable to full takeover a few weeks ago, and there is a real chance it still is.

Security researchers have confirmed active, in-the-wild exploitation of a chained attack called WP2Shell. It combines two vulnerabilities in WordPress Core itself, not a plugin, not a theme, the actual software every WordPress site runs on. Chained together, they let an attacker with zero credentials run arbitrary code on your server.

As a Cybersecurity professional with expertise in Offensive security, this is the kind of vulnerabilities that are very dreadful. Not just because it is a very clever trick and hard to detect, but because of how many site are quietly exposed by this because of the mere assumptions like : "I don't use sketcht plugins so I'm fine"

You're not fine by default. Here's why, and what to actually do about it.

What WP2Shell actually is

The vulnerablity "chain" was discovered by a researcher named Adam Kues at Searchlight Cyber and involves two CVEs (Common Vulnerabilities and Exposures). In case you don't know what that means, it is a publicly accessible dictionary that catalogs and standardizes identification numbers for publicly disclosed cybersecurity vulnerabilities in software and hardware. Each unique identifier follows a standard format (e.g., CVE-2026–63030) and is managed globally by the CVE Program.

The Two CVEs found were:

CVE-2026–63030, a Critical vulnerability that lives in WordPress's Batch REST API. When the API processes certain grouped requests, it can misapply security checks, letting specially crafted requests reach parts of the system that should require authentication and CVE-2026–60137, Moderate vulnerablity which is a SQL injection flaw elsewhere in WP Core.

Neither one alone is catastrophic. Chained, they add up to pre-authentication remote code execution.

In simple terms, an attacker doesn't need a username, a password, or a session. They send the right request to the right endpoint, and they get a shell on your server.

Searchlight Cyber has intentionally withheld the technical exploit chain given the severity, which is the right call and this article won't reproduce it either due to the same reason. What matters for you is the vulnerability scope and response action, not proof-of-concept code.

Why this WordPress vulnerabilty is different

Most WordPress compromises trace back to an outdated plugin or a sloppy theme. That's been true for years, and it's why "just be careful what you install" became the standard advice.

WP2Shell breaks that assumption. It affects a stock WordPress install with no plugins at all. If your site is running an affected Core version, having zero third-party code doesn't save you.

Security firm WatchTowr has reported seeing active exploitation attempts. Estimates cited by TechCrunch put roughly 90 million sites directly exposed to the exploit chain, out of more than 400 million running WordPress versions in the affected range. Not every one of those is exploitable in practice, but the range gives you a sense of the blast radius.

Who does this affect directly

Affected versions, per Searchlight Cyber's advisory:

• WordPress 6.9.0 through 6.9.4
• WordPress 7.0.0 through 7.0.1

WordPress 6.8.5 and earlier are not affected by this chain.

If you're a developer maintaining client sites, an agency running dozens of WordPress installs, or an enterprise team with WordPress somewhere in your stack (marketing sites and blogs count), check every single instance. Not just the ones you remember updating.

How to check if you're affected

Disclaimer!!! the steps below are for checking systems you own or are authorized to test. Running vulnerability checks against a site you don't have permission to test is unauthorized access in most jurisdictions, regardless of intent. This section is for education and legitimate defensive use only.

For your own sites:

1. Check your WordPress version. Log into wp-admin and look at Dashboard > Updates, or check the version footer. If you're on 6.9.0 to 6.9.4 or 7.0.0 to 7.0.1, treat this as urgent.
2. Use the official checker. Searchlight Cyber released a free tool at wp2shell.com specifically to let site owners verify exposure without needing the withheld technical details. Use it on sites you control.
3. Check for existing compromise. Look for unfamiliar admin users, unexpected files in wp-content, and requests to /wp-json/batch/v1 in your server logs that you can't explain. If you find any of these, treat it as a suspected breach, not just a patching task.
4. If you manage multiple sites, script a version check across your fleet rather than checking site by site. A CVE like this is exactly why asset inventory matters more than any single control. If you something like this. Let me know in the comment section.

Remediation of WP2Shell

The fix itself is simple. Actually doing it, fleet-wide, before an opportunistic attacker gets there, is the hard part.

Update immediately to WordPress 7.0.2, or 6.9.5 if you're staying on the 6.9 branch. WordPress has enabled automatic security updates for this one, which is a strong signal of how seriously the maintainers are treating it.

If you can't update right away (some enterprise environments need to test updates against custom code first), Searchlight Cyber recommends a temporary mitigation: block anonymous access to the Batch REST API. You can do this by:

• Installing a plugin that blocks anonymous access to the REST API entirely, or
• Blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 at your WAF or reverse proxy

Both of these are stopgaps, not fixes. They can break legitimate functionality that relies on the REST API, and they should come off as soon as you've patched.

Longer term, this is a good moment to fix the habit, not just the bug:

• Turn on automatic updates for WordPress Core where your environment allows it
• If auto-updates aren't feasible, set up monitoring that alerts you the moment a security release drops
• Test updates on staging before production, but keep that test window measured in hours, not weeks
• Maintain an actual inventory of every WordPress instance your organization runs, including the ones marketing spun up two years ago and forgot about

Conclusion

Here's what gets me about this one. The patch existed. Automatic updates were enabled. And attackers are still getting in.

That's not a WordPress problem specifically. It's what happens whenever the gap between "patch released" and "patch applied everywhere" is measured in weeks instead of hours. Attackers reverse-engineer patches fast now, sometimes within days of release, and they go straight for whoever hasn't moved yet.

Microsoft has started telling enterprise customers to patch within three days for this exact reason. WP2Shell is the WordPress-flavored version of the same lesson: security updates aren't a quarterly task anymore. They're closer to a fire alarm.

If you're a developer, this is also a conversation worth having with clients who think "WordPress is easy, I don't need a security retainer." Core vulnerabilities like this one are exactly the argument for ongoing maintenance, not a one-time build.

What's your actual time-to-patch for a critical CVE like this? Hours, days, or "whenever someone notices"?

About the author

Ajekigbe Michael is a cybersecurity and AI content writer, security researcher, and advisor on secure AI integration for startups. He writes about the human side of digital security and loves to help build secure AI and cloud solutions.