WordPress core has a critical unauthenticated remote code execution (RCE) vulnerability named wp2shell (CVE-2026-63030) affecting versions
The WordPress development team released a security update on July 17, including the official versions 7.0.2, 6.9.5, 6.8.6, and the beta version 7.1 beta2, focusing on patching two critical vulnerabilities: CVE-2026-63030 and CVE-2026-60137[1]. The major-severity CVE-2026-63030, named "wp2shell" by cybersecurity company Searchlight Cyber, exists in WordPress core's REST API mechanism[1]. This vulnerability allows attackers to execute remote code (RCE) directly via an anonymous user account without any authentication, classifying it as a Pre-auth RCE type[1]. Given that WordPress is deployed on over 500 million websites globally and the vulnerability resides in the core without requiring additional conditions for exploitation, its potential impact scope is extremely broad[1]. Searchlight Cyber has not yet disclosed detailed technical details but has established an official website, wp2shell.com, to assist administrators in detecting whether their sites are affected[1].
The core mechanism of the wp2shell vulnerability combines REST API Batch-route confusion with an SQL injection weakness[1]. Attackers exploit WordPress's Batch API endpoint, triggering SQL injection by obfuscating route parameters to bypass security checks and execute arbitrary code[1]. This vulnerability affects WordPress versions above 6.9.0 (specifically 6.9.0–6.9.4 and 7.0.0–7.0.1), with a CVSS risk score of 9.8, indicating an extremely high-risk level[1]. Since the vulnerability is in the core and requires no authentication, attackers can exploit it directly without possessing account credentials, making automated attack tools highly prone to rapid dissemination[1]. Cybersecurity company Rapid7 noted that as AI accelerates vulnerability analysis and WordPress source code is public, proof-of-concept (PoC) code for this vulnerability is expected to emerge quickly[1]. Cloudflare announced that their Web Application Firewall (WAF) has added relevant rules to protect both free and paid users[1].
CVE-2026-63030 affects WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1[1]. With over 500 million websites globally using WordPress, the number of potentially affected nodes is enormous[1]. As a Pre-auth RCE vulnerability, attackers can execute system commands directly via anonymous requests, potentially leading to server malware injection, database theft, or complete website takeover[1].
The primary protection measure is to immediately upgrade the WordPress core to secure versions: 7.0.2, 6.9.5, or 6.8.6[1]. If updating is temporarily impossible, alternative mitigation measures include blocking anonymous users from accessing the Batch API, though these methods may affect normal website operations[1]. Cloudflare has provided WAF protection rules for users; enabling relevant protections is recommended[1].