wp2shell: The WordPress Vulnerability That Lets Anyone Take Over Your Site — What to Check Right Now

I'll get straight to it, because this one has a real clock attached: if you run a WordPress site and haven't checked your version number in the last week, stop after this paragraph and go do that first. A vulnerability chain called wp2shell lets an attacker take full control of a default WordPress installation — no login, no plugin required, no user needing to click anything — and it's already being actively exploited in the wild. This isn't a theoretical risk sitting in a research paper. It's happening right now, against real sites. The direct answer: wp2shell is an exploit chain combining two WordPress Core vulnerabilities — CVE-2026-63030 and CVE-2026-60137 — that lets an unauthenticated attacker create a fake administrator account and execute code on a vulnerable site. It affects WordPress versions 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. Patches are available in 6.8.6, 6.9.5, and 7.0.2. Active exploitation was confirmed within days of the July 17, 2026 disclosure, and both CVEs are now on CISA's Known Exploited Vulnerabilities catalog. Quick Facts DetailInfoVulnerability namewp2shellCVEs involvedCVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection)DisclosedJuly 17, 2026SeverityCVE-2026-63030 rated High (CVSS 7.5); CVE-2026-60137 rated High to Critical depending on the sourceAuthentication requiredNone — fully unauthenticatedPlugin requiredNone — lives entirely in WordPress CoreAffected versions6.8.0-6.8.5, 6.9.0-6.9.4, 7.0.0-7.0.1Patched versions6.8.6, 6.9.5, 7.0.2Active exploitation confirmedYes — within 24-72 hours of disclosure, per multiple security firmsAdded to CISA's KEV catalogJuly 21, 2026Discovered bySearchlight Cyber What Is wp2shell, in Plain Language? wp2shell isn't one bug — it's two separately tracked WordPress Core vulnerabilities that become far more dangerous when chained together. On its own, CVE-2026-60137 is a SQL injection flaw in how WordPress handles a specific query parameter, but it normally requires a logged-in account to reach. That's the kind of bug that would usually get patched quietly with modest urgency. The second flaw, CVE-2026-63030, is what turns it into an emergency. It's a logic error in WordPress's REST API batch endpoint — a feature that lets applications bundle multiple requests into one API call. Because of how that endpoint validates requests separately from how it executes them, a specially malformed request can slip past the validation step and get executed anyway, under the wrong handler entirely. Chained together, that logic flaw gives an anonymous, unauthenticated visitor a path to trigger the SQL injection flaw that would normally require a login — ultimately letting them forge an administrator account and execute code on the site. The batch API endpoint this relies on has existed in WordPress since version 5.6, meaning the entry point has been sitting on a massive installed base for years, even though the specific chain of bugs enabling this attack is new. Security researchers have described this as one of the more serious WordPress Core vulnerabilities in recent memory specifically because it requires nothing from the victim — no plugin misconfiguration, no tricking a user into clicking anything, not even a valid account. It works against a default installation, out of the box. Is Your Site Actually Affected? WordPress VersionStatus6.8.0 – 6.8.5Affected (SQL injection component present) — update to 6.8.6+6.9.0 – 6.9.4Affected (full exploit chain) — update to 6.9.5+7.0.0 – 7.0.1Affected (full exploit chain) — update to 7.0.2+6.8.6 or laterPatched6.9.5 or laterPatched7.0.2 or laterPatched If your site auto-updates for minor WordPress releases — which is the default behavior for most installations — there's a real chance you've already received the patch without doing anything. WordPress reportedly took the unusual step of force-pushing this update through its automatic update system to all supported installations given the severity involved. That doesn't mean you should assume you're safe, though — some hosting environments and manually managed sites disable auto-updates specifically, and those need manual attention immediately. How to Check Your Site Right Now Check your version number. Log into your WordPress admin dashboard and look at the version listed on the Dashboard or Updates page. Compare it against the table above. Check your update settings. If your site has automatic background updates disabled, or if you manage WordPress core updates manually as a matter of policy, don't assume the patch applied itself. Go update manually. If you can't log in normally, that itself is a warning sign. Given that this exploit chain can be used to create fake administrator accounts, review your user list for any admin-level accounts you don't recognize, particularly ones created recently. Also check for unexpected changes to site files, unfamiliar scheduled tasks, or unusual outbound traffic from your serv