A critical, pre-authentication remote code execution vulnerability in WordPress Core has security teams scrambling this week. Nicknamed “wp2shell” by the researchers who found it, the bug can hand a completely anonymous attacker full control over a vulnerable site, and it doesn’t require a single installed plugin to pull off.

How the Attack Works

The flaw was uncovered by researcher Adam Kues of Searchlight Cyber’s Assetnote research team. At its core, wp2shell stems from confusion in how WordPress Core handles REST API batch routes, an issue that cascades into a SQL injection vulnerability and ultimately full remote code execution. Two CVE identifiers are tracking the issue: CVE-2026-60137, which covers the SQL injection component, and CVE-2026-63030, which covers the batch-route RCE chain that Kues identified.

What separates this from a typical WordPress security scare is the total absence of preconditions. There’s no need for a compromised plugin, a misconfigured setting, or even a user account. An attacker only needs network access to a WordPress instance running an affected version, and the REST API does the rest.

Who’s Affected

The exposure spans a specific band of WordPress Core releases:

• WordPress 6.8.5 and earlier are not affected by the RCE chain, though the 6.8 branch is affected by the SQL injection component (CVE-2026-60137), which has been backported to a 6.8.6 fix.
• WordPress 6.9.0 through 6.9.4 are affected.
• WordPress 7.0.0 through 7.0.1 are affected.
• The 7.1 pre-release beta is affected as well.

Given that WordPress powers a substantial share of the web, Searchlight Cyber estimates the vulnerable install base at more than 500 million sites, making this one of the broadest-reaching CMS vulnerabilities disclosed this year.

Responsible Disclosure and Emergency Patching

Because of the severity and the ease of exploitation, Searchlight Cyber deliberately withheld the technical exploit details from public release, giving site operators a head start on patching. The firm did, however, publish a free scanner at wp2shell.com so administrators can quickly check whether a given install is vulnerable without needing deep technical expertise.

WordPress.org responded with version 7.0.2, and the fix is reportedly being pushed automatically to sites running affected versions through the platform’s auto-update system rather than waiting on manual intervention. Site owners who prefer to act directly can update from the WordPress Dashboard under Updates, or download the new release straight from WordPress.org.

Credit for the discovery is shared among several researchers: TF1T, dtro, and haongo jointly reported the underlying SQL injection issue, while Kues is credited with identifying the more severe batch-route RCE chain.

What to Do If You Can’t Patch Immediately

For administrators who can’t update right away, Searchlight Cyber has outlined temporary mitigations, with the caveat that they may break legitimate site functionality:

• Install a plugin or firewall rule that blocks anonymous access to the REST API entirely.
• Block the /wp-json/batch/v1 and ?rest_route=/batch/v1 endpoints at the web application firewall layer.
• Treat both of these as short-term stopgaps only, and apply the official patch as soon as feasible.

Security teams are urging site owners to prioritize the real fix over workarounds. Given the scale of WordPress’s footprint and the zero-click nature of the exploit, this is exactly the kind of vulnerability that tends to see mass automated scanning within days of disclosure. Sites that delay patching risk becoming easy, low-effort targets for opportunistic attackers running the same scanner tooling that defenders are using to check for exposure.

Beyond the immediate patch, this incident is a useful prompt for WordPress administrators to review their update automation settings, confirm auto-updates are actually enabled for core releases, and audit which REST API endpoints are exposed to the public internet in the first place.