A critical vulnerability chain called wp2shell is being actively exploited against WordPress websites right now. It allows attackers to execute code on your server remotely, without needing a login, without needing any plugins installed, and without any action from you or your users. If your WordPress site is running version 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1, you need to update immediately.
This is not a theoretical risk. Public exploit code is circulating and mass exploitation is underway. Default WordPress installations are vulnerable out of the box.
What Is wp2shell?
wp2shell is the name given to a chain of two vulnerabilities that, when combined, give an attacker full remote code execution (RCE) on a default WordPress installation. No plugins required. No user interaction required. No authentication required.
The two vulnerabilities in the chain are:
- CVE-2026-63030 — a REST API Batch-Route Confusion flaw in the
/wp-json/batch/v1endpoint. This allows an unauthenticated attacker to bypass access controls and reach internal API routes that should be restricted. - CVE-2026-60137 — a SQL Injection vulnerability in the
author__not_inparameter ofWP_Query. Once the attacker can reach internal routes via the first flaw, this injection allows them to manipulate database queries and ultimately execute arbitrary code on the server.
How the Attack Works
In simplified terms, the attack works in two steps:
- Bypass the front door. WordPress has a batch API endpoint (
/wp-json/batch/v1) that lets multiple API requests be sent in a single call. The route confusion bug means an attacker can craft a batch request that tricks WordPress into processing internal API calls that would normally require authentication — without any credentials. - Inject through the gap. Once inside, the attacker exploits the SQL injection flaw in the
author__not_inquery parameter. This lets them manipulate the database directly, which in WordPress can be leveraged to write files to the server or modify existing ones — giving them a web shell and full control.
The reason this is so dangerous is that both vulnerabilities exist in WordPress core. No plugins, no themes, no misconfigurations needed. A fresh, default WordPress install is vulnerable.
Am I Vulnerable?
You are affected if your WordPress site is running any of these versions:
- WordPress 6.9.0, 6.9.1, 6.9.2, 6.9.3, or 6.9.4
- WordPress 7.0.0 or 7.0.1
Versions older than 6.9 are not vulnerable to the full unauthenticated chain. However, if you are running older unsupported versions, you have other problems — update regardless.
You can check your WordPress version by logging into your admin dashboard and looking at the bottom-right corner, or by navigating to Dashboard → Updates.
What to Do Right Now
Step 1: Update WordPress immediately
Patches were released on 17 July 2026. Update to:
- WordPress 6.9.5 (if you are on the 6.9 branch)
- WordPress 7.0.2 or newer (if you are on the 7.0 branch)
If you have automatic updates enabled, check that the update has actually applied. Do not assume it has — log in and verify.
Step 2: If you cannot update immediately, block the endpoint
If updating is not possible right now (staging environments, compatibility testing, change management processes), implement a temporary WAF rule or server-level block to restrict access to /wp-json/batch/v1. This is not a permanent fix, but it closes the entry point while you prepare to update.
For Nginx, add a location block that returns 403 for that path. For Apache, use a RewriteRule. For Cloudflare or other WAFs, create a custom rule blocking requests to the batch endpoint.
Blocking the batch endpoint may affect some plugins that rely on it. This is a temporary measure — the real fix is updating WordPress.
Step 3: Check for signs of compromise
If your site was running an affected version between now and when the exploit became public, check for:
- Unfamiliar files in your WordPress root or
wp-contentdirectory (especially PHP files with random names) - Modified core files — run
wp core verify-checksumsif you have WP-CLI access - New or unfamiliar admin user accounts
- Unexpected database changes or content modifications
Why This Matters Even If You Do Not Run WordPress
WordPress powers roughly 40% of the web. If your business uses a WordPress site — even a simple brochure site built by an agency years ago — it could be running a vulnerable version right now with nobody actively maintaining it. These are exactly the sites attackers target first: unpatched, unmonitored, and forgotten.
Key takeaway
wp2shell is a critical, actively exploited vulnerability chain that gives attackers full control of unpatched WordPress sites. Update to WordPress 6.9.5 or 7.0.2 immediately. If you cannot update, block the /wp-json/batch/v1 endpoint as a temporary measure.
If you are not sure whether your website is vulnerable or need help checking, get in touch. Our cybersecurity team can audit your site and verify it is patched and clean.
Related: Best cybersecurity tools for small business UK · What to do when your business gets hacked
Want to talk about this?
Book a free 15-minute call and we'll discuss how this applies to your business.
Get IT tips in your inbox
Practical advice for small businesses. No spam.