WP2Shell WordPress vulnerability enables website takeover without login
- Evelyn Carter
- 2 days ago
- 4 min read
On July 17, 2026, WordPress released emergency fixes for WP2Shell, an exploit chain combining CVE-2026-63030 and CVE-2026-60137. WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1 may be remotely compromised without authentication. In-the-wild exploitation was reported after public proof-of-concept code became available.
WordPress activated forced automatic updates for affected releases, a measure generally reserved for particularly serious security issues. Searchlight Cyber estimates that more than 500 million websites use WordPress, although this figure should be treated as an estimate of the ecosystem’s scale rather than a confirmed count of vulnerable websites.
What happened in WordPress core?
On July 17, 2026, WordPress released version 7.0.2 to address one critical and one high-severity security issue. Corresponding fixes were also backported to older branches through WordPress 6.9.5 and 6.8.6.
The exploit chain, referred to by the security community as WP2Shell, consists of two vulnerabilities:
CVE-2026-60137: A SQL Injection vulnerability associated with query processing in WordPress.
CVE-2026-63030: A route confusion flaw in the REST API Batch mechanism that may allow unauthenticated requests to reach routes that normally require authorization.
WP2Shell is not a single vulnerability. CVE-2026-60137 provides the SQL Injection weakness, while CVE-2026-63030 changes the routing and authorization context of REST API requests. Together, they turn a limited flaw into an unauthenticated attack path.
Which WordPress Versions Must Be Updated?
Websites running WordPress 6.9 or 7.0 before the patched releases should be treated as priority remediation targets. Websites on the 6.8 branch must also be updated because they remain exposed to the standalone SQL Injection vulnerability.
WordPress Branch | Affected Versions | Impact | Patched Version |
6.8 | 6.8.0–6.8.5 | CVE-2026-60137 only; no complete WP2Shell chain | 6.8.6 |
6.9 | 6.9.0–6.9.4 | Both vulnerabilities; complete WP2Shell chain possible | 6.9.5 |
7.0 | 7.0.0–7.0.1 | Both vulnerabilities; complete WP2Shell chain possible | 7.0.2 |
Earlier than 6.8 | Not affected according to WordPress | Outside the scope of these two fixes | Move to a supported release |
Organizations that have previously handled WordPress plugin vulnerabilities should note the difference in this incident. The article on WordPress plugin vulnerabilities threatening millions of websites explains third-party supply-chain risks, while WP2Shell is different because a standard WordPress installation without plugins may still be affected.
How does the WP2Shell exploit chain work?
WP2Shell abuses the way WordPress processes multiple REST API requests inside a single batch. An attacker can send a specially crafted request to /wp-json/batch/v1 and cause WordPress to confuse routing and authorization contexts.
A potential attack sequence may look like this:
The attacker identifies a website running WordPress 6.9.0–6.9.4 or 7.0.0–7.0.1.
A specially crafted HTTP request is sent to the REST API Batch endpoint.
WordPress incorrectly processes the route and authorization context inside the batch.
The SQL Injection vulnerability is triggered in the unintended context.
The attacker creates an administrator account or modifies security-sensitive data.
The new account is used to install a malicious plugin, deploy a webshell, or maintain persistence.
How serious is in-the-wild exploitation?
WP2Shell has moved beyond a purely theoretical risk. SecurityWeek and Coalition Security Labs reported that exploitation activity appeared shortly after the vulnerabilities were disclosed on July 17, 2026.
Public proof-of-concept code also makes it easier for multiple threat actors to automate the discovery of unpatched websites. Qualys noted that public exploit code had become available for both CVE-2026-63030 and CVE-2026-60137.
What should businesses do in the first 24 hours?
Immediate response checklist
Inventory all WordPress websites, microsites, and service portals.
Identify the exact WordPress Core version on every system.
Upgrade to WordPress 7.0.2, 6.9.5, or 6.8.6, depending on the active branch.
Verify that the update completed successfully instead of relying only on automatic update notifications.
Preserve backups of files, databases, and logs before beginning deeper investigation.
Review newly created administrator accounts, unknown users, and unusual privilege changes.
Inspect plugins, themes, and PHP files created or modified near the disclosure period.
Search for unusual requests to /wp-json/batch/v1 and ?rest_route=/batch/v1.
Rotate credentials, WordPress salts, and API keys when compromise is suspected.
Isolate the server and activate incident response procedures when webshells or unauthorized access are confirmed.
What does the IPSIP Vietnam expert perspective show?
WP2Shell demonstrates that security risk can originate in the core component of a widely deployed platform. The technical issue results from the interaction between REST API Batch route handling and the way untrusted input reaches SQL query construction.
What can businesses implement internally?
Businesses should establish a tested patch-management process, monitor WordPress file changes, restrict administrator privileges, and segment website infrastructure from internal systems. Web server, WAF, WordPress, and operating system logs should be centralized to support detection and investigation.
Vulnerability scanning helps identify unpatched websites, while penetration testing is appropriate when an organization needs to verify exploitability and business impact in its own architecture. IPSIP’s article on the difference between penetration testing and vulnerability scanning can help businesses select the appropriate assessment method.
Which IPSIP Vietnam's services are relevant?
For businesses operating multiple websites or lacking a complete asset inventory, IPSIP’s website vulnerability scanning service can help identify outdated versions and known weaknesses exposed to the Internet. Results should be validated against the actual WordPress version and patch status.
Where organizations need to determine whether a weakness is exploitable in a specific architecture, IPSIP Pentest services use controlled testing to assess attack feasibility and potential impact. Penetration testing should follow emergency remediation and must not delay the installation of WP2Shell patches.
For critical systems that require continuous monitoring, the IPSIP SOC 24/7 service can support centralized logging, anomaly detection, and response coordination when exploitation or persistence activity is identified.
After emergency remediation, organizations should formalize patch management, centralized logging, and periodic security testing. Combining prevention, detection, and response can reduce the likelihood that a website vulnerability develops into a data breach or operational disruption.
References
Comments