· 8 min read

A WordPress core bug needs no password and no plugins to take over your site

Tools Lessons

If you run WordPress and your mental model of risk is "I don't install sketchy plugins, so I'm fine," CVE-2026-63030 should change that. It's a pre-authentication remote code execution bug in WordPress core, the software itself, not a theme or a plugin, and it means an attacker who has never logged in and knows nothing about your site can hand themselves a working shell. The bug has a name, wp2shell, and it was actively exploited within days of becoming public in July 2026.

What wp2shell actually is

wp2shell is the researcher nickname for a chain of two WordPress core vulnerabilities: CVE-2026-63030 and CVE-2026-60137. On their own, each is bad. Chained together, they let an unauthenticated attacker execute arbitrary code on a default WordPress install, one with zero third-party plugins, nobody logged in, nothing misconfigured. That last part is what makes this different from the plugin RCEs I've written about before on this blog. Those needed you to be running the vulnerable plugin. This one just needs you to be running WordPress.

The affected range is specific: WordPress 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. There's also a narrower issue: sites on 6.8.0 through 6.8.5 carry the SQL injection half of the chain (CVE-2026-60137) on its own, which is why WordPress shipped a fix for that branch too. The fixes landed in 6.9.5, 7.0.2, and 6.8.6, all released July 17, 2026, the same day the vulnerability went public via a GitHub Security Advisory.

How the chain actually works

I'll keep this at the level a non-security-engineer solo operator needs, because the full writeups from Rapid7 and others get deep into WordPress internals fast.

The entry point is the REST API batch endpoint, /wp-json/batch/v1, a feature that lets a single request bundle multiple sub-requests together. WordPress core validates each sub-request and then executes it, in two separate passes. The bug: when one of those sub-requests has a path that fails to parse with wp_parse_url(), the error gets recorded in the validation array but not in the matches array used at execution time. That mismatch desyncs the two arrays, and a later sub-request in the same batch ends up dispatched through the wrong handler entirely, not the one it was validated against.

From there, an attacker routes a request into WP_Query through the author__not_in parameter, which turns out to be vulnerable to SQL injection (that's CVE-2026-60137, present since WordPress 6.8). SQL injection plus a handler-confusion bug that lets you smuggle a request past validation adds up to remote code execution, no credentials required at any step.

The exploitation timeline moved fast

This wasn't a theoretical bug that sat quietly for months. The advisory went public July 17, 2026, and proof-of-concept exploits showed up on GitHub within days (one, from researcher 4minx, is still sitting there for anyone to run). CISA added both CVE-2026-63030 and CVE-2026-60137 to its Known Exploited Vulnerabilities catalog on July 21, four days after disclosure, which is CISA's way of confirming they'd seen it used in real attacks, not just demonstrated in a lab. WordPress.org's response was to push forced automatic core updates to affected installations, which is the right call for a bug this severe, but forced updates only work on sites that have automatic updates actually turned on and functioning.

I don't have a solid, sourced number on what fraction of WordPress installs are still running an unpatched version right now, in September. What I can say with confidence, because I've watched it happen on sites I manage myself, is that WordPress core updates lag for months on a meaningful chunk of the installed base: managed hosts that disable auto-updates by client request, agencies that batch updates quarterly, sites nobody has logged into since the plugin that needed manual attention. That pattern is well established independent of this specific CVE, and it's exactly the population still exposed.

The two-minute check

You don't need a security background for this one. Here's what to actually do, today, for every WordPress site you're responsible for:

  • Log into wp-admin and check Dashboard > Updates, or run wp core version if you have WP-CLI access, to confirm you're on 7.0.2, 6.9.5, 6.8.6, or later.
  • If you're behind, update immediately. This is not a "schedule it for next sprint" bug given the confirmed in-the-wild exploitation.
  • Check Settings > General (or your host's dashboard) to confirm automatic core updates are actually enabled and actually running, not just configured. Many managed hosts turn this off by default or override it per client, and "I assumed it was on" is exactly how sites end up exposed for months.
  • If you manage it, check your access logs or WAF for POST requests to /wp-json/batch/v1. That's the entry point, and traffic there from unfamiliar IPs is worth investigating even after you patch.
  • If you can't patch immediately for some reason (a frozen client environment, a compatibility concern), block or rate-limit /wp-json/batch/v1 at the WAF or plugin firewall level as an interim measure. It's not a real fix, it's a tourniquet.

What I'd actually do

I run triathlon.info.pl on WordPress, and I manage it the way most solo operators manage a secondary property: not every day, definitely not with the vigilance I'd apply to something that's my main income. This CVE is a good reminder that "secondary" doesn't mean "lower stakes" when the attack needs nothing from you except an internet connection and a version number in the vulnerable range.

My actual recommendation: check your version today, not this week. If you're already on a fixed release, or on managed hosting that forces core updates and you've confirmed it actually applied, this is genuinely a non-event for you, and I'd say that honestly rather than manufacture urgency where none exists. If you're not sure whether auto-updates are working, that uncertainty is the thing to resolve first, because "I think it's on" is not the same as "I checked and it ran." For anyone managing more than one WordPress site as a side project or for clients, this is the specific, concrete reason to put a recurring fifteen-minute version check on your calendar instead of trusting that updates just happen in the background.

Author

Lukas

Sources

More Tools articles →

Stay in the Loop

Get new posts delivered to your inbox. No spam, unsubscribe anytime.

Newsletter coming soon. Set PUBLIC_CONVERTKIT_FORM_ID in .env to activate.

Related Posts