If you run a WordPress site and you haven't updated in the last 72 hours, stop what you're doing and patch. Seriously.
Security researchers at Searchlight Cyber discovered a two-vulnerability chain in WordPress Core that lets unauthenticated attackers take over a website completely. No special plugins. No weird configurations. Just a default WordPress installation on versions 6.9.x before 6.9.5 or 7.0.x before 7.0.2. They called it wp2shell, and the name tells you everything you need to know.
What's actually happening
The chain works like this. CVE-2026-63030 (CVSS 9.8, critical) is a REST API batch-route confusion bug that lets an attacker bypass authentication entirely. Pair that with CVE-2026-60137, an SQL injection through the author__not_in parameter, and you have a remote code execution path that requires zero credentials to trigger.
Multiple proof-of-concept exploits are already public on GitHub. Wiz's research team confirmed active exploitation in the wild, including malicious plugin uploads and admin panel access. They also found that 60% of organizations had vulnerable instances when they checked. High-volume scanning to identify vulnerable targets is underway right now. VulnCheck has verified more than two dozen unique PoCs targeting wp2shell as of July 19.
WordPress has enabled forced automatic updates for affected installations. But if you have ever managed a WordPress site, you know that auto-updates do not always reach every instance. Custom setups, managed hosts that delay rollouts, and sites with automatic updates disabled are all sitting ducks.
Why this one is different
We see WordPress vulnerabilities all the time. Most require a vulnerable plugin or a specific configuration. This one does not. It is in Core. It is pre-auth. And attackers are actively weaponizing it.
Cloudflare deployed WAF rules across all plans including the free tier, which is a solid safety net if you are behind their proxy. But WAF rules can be bypassed. The only real fix is the patch.
There is also a free scanning tool at wp2shell.com if you want to check whether your site is vulnerable. Handy for agencies managing multiple WordPress installations.
What you need to do right now
Here is your playbook:
- Update WordPress immediately to version 6.9.5 or 7.0.2, depending on your branch
- Check your sites manually even if you think auto-updates are enabled. Log in and verify the version number
- Scan for indicators of compromise. Look for unfamiliar admin users, unknown plugins, or suspicious files in
wp-content/uploads/ - Enable Cloudflare's WAF if you are using it, or consider adding a web application firewall if you are not
- Run the free scanner at wp2shell.com across every WordPress site you manage
If you find evidence of compromise (weird admin accounts, strange files, unexpected outbound connections), do not just patch. Assume the site is fully compromised and rebuild from a known-good backup. Attackers are dropping backdoors that survive the update.
This is one of those moments where speed matters more than perfection. The exploit code is public. The scanning is active. The window between "we should patch" and "we should have patched" is closing fast.
Not sure if your WordPress environment is secure or want a second pair of eyes on it?
Book a 15-minute security check
No obligation, no sales pitch. Just a straight answer on where you stand.