A critical WordPress core flaw: CVE-2026-63030 (a route-confusion flaw in the REST API batch processor) chained with CVE-2026-60137 (SQL injection), enabling unauthenticated remote code execution (pre-auth RCE) on a stock install with no plugins. Actively exploited to install webshells.

Which versions are affected and how do I protect myself?

Affected: WordPress Core 6.9.0–6.9.4 and 7.0.0–7.0.1. The fix is in 6.9.5 and 7.0.2 (17 July 2026), delivered via automatic security updates. Update immediately or confirm the auto-update was applied.

How do I know if I was compromised?

Check the indicators: webshells with randomized filenames in /wp-content/cache/, newly created administrator accounts, and malicious plugins disguised as legitimate add-ons. If you find signs, treat the site as breached: isolate it, rotate passwords and keys, and restore from a clean backup taken before the incident.

How quickly was it exploited?

Very quickly: on the evening the fixes shipped (17 July), probing began (23:29 UTC, per Wordfence/Defiant), followed by SQL injection attempts 13 minutes later. In-the-wild exploitation was confirmed on 18–20 July, with public exploits.

wp2shell: a critical WordPress flaw exploited to install webshells

A critical flaw in the WordPress core, dubbed wp2shell, is being actively exploited to install webshells and take over sites. The attack has no preconditions and works on a stock install with no plugins. Below are the facts and, at the end, what to do.

In brief

Affected: WordPress Core — versions 6.9.0–6.9.4 and 7.0.0–7.0.1.
Vulnerabilities: CVE-2026-63030 (a route-confusion flaw in the REST API batch processor) chained with CVE-2026-60137 (SQL injection).
Impact: unauthenticated remote code execution (pre-auth RCE) on a stock install, no plugins required.
Fix: 6.9.5 and 7.0.2, released on 17 July 2026, via automatic security updates.
Status: actively exploited in the wild, with public exploits available.

How does it work, in brief?

WordPress 6.9 introduced a batch REST API (/wp-json/batch/v1) that validates and executes sub-requests in separate loops.
CVE-2026-63030: when wp_parse_url() fails on a sub-request path, the error is pushed to the validation array but not the matches array — the two desynchronize, and subsequent requests are dispatched to the wrong handler.
Through that confusion, the attacker reaches an SQL injection in WP_Query (CVE-2026-60137) and, ultimately, the creation of an administrator account — without authenticating.

Exploited in the wild

17 July 2026: the fixes shipped (6.9.5 / 7.0.2). Probing began the same evening; per the firm Defiant (Wordfence), at 23:29 UTC, followed by SQL injection attempts 13 minutes later.
18–20 July 2026: in-the-wild exploitation is confirmed, with public exploits in circulation.
In observed attacks, actors mass-scan, upload malicious plugins, install PHP webshells (including obfuscated variants), extract admin credentials via REST API queries, and attempt local file inclusion against wp-config.php.
A Macnica researchers’ dashboard reported an 81.6% patch rate across 124,580 evaluated sites — meaning roughly one in five was still vulnerable.

Indicators of compromise

webshells in the /wp-content/cache/ directory, with randomized filenames;
newly created administrator accounts;
malicious plugins disguised as legitimate add-ons.

What to do now?

Update immediately to WordPress 6.9.5 or 7.0.2 (or confirm the automatic update was applied).
Check the indicators above: unknown files in /wp-content/cache/, new administrators, unfamiliar plugins.
If you find signs of compromise, treat the site as breached: isolate it, rotate passwords and keys, and restore from a clean backup taken before the incident.