What happened?
On 17 July, WordPress released emergency security updates to address WP2Shell, a critical exploit chain affecting WordPress Core that enables unauthenticated remote code execution (RCE). Unlike many WordPress compromises that originate from vulnerable plugins, themes, or stolen credentials, WP2Shell impacts the core platform itself and can be exploited without authentication, significantly increasing the potential risk to vulnerable installations.
WP2Shell is a critical WordPress Core exploit chain combining CVE-2026-63030, a REST API batch-route confusion vulnerability, and CVE-2026-60137, a SQL injection vulnerability, affecting WordPress versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1.
Individually, both vulnerabilities present a significant security risk. When combined, however, they allow an unauthenticated attacker to bypass intended access controls and ultimately execute arbitrary code on a vulnerable server - successful exploitation can result in full compromise of an affected WordPress installation, enabling an attacker to install backdoors, deploy webshells, create administrative accounts, modify website content, and maintain persistent access.
WordPress has released fixes in versions 6.9.5 and 7.0.2.
So what?
WordPress powers a substantial proportion of internet-facing websites, making vulnerabilities in WordPress Core particularly attractive to threat actors. Unlike vulnerabilities affecting individual plugins or themes, a Core vulnerability provides a significantly larger pool of potential targets and often requires less reconnaissance to identify exploitable systems.
Although early reporting indicated no confirmed in-the-wild exploitation, that position changed rapidly following the publication of proof-of-concept material, as multiple security vendors, threat intelligence organisations, and government agencies subsequently reported active attacks targeting vulnerable WordPress installations.
Researchers have reported attackers creating webshells within the /wp-content/cache/ directory, often using randomised filenames and concealed access methods designed to evade detection. Other campaigns have involved the installation of malicious plugins that expose additional REST API functionality, allowing attackers to retain remote access long after the initial compromise.
The incident also highlights a broader trend that has become increasingly common across the threat landscape: the shrinking window between disclosure and exploitation. While researchers initially withheld detailed technical information to provide defenders with time to patch, proof-of-concept material emerged shortly afterwards, followed by confirmed exploitation activity.
What should I do?
Organisations operating WordPress installations should immediately verify that security updates have been successfully applied and should not assume automatic updates completed without issue. Patching alone may not be sufficient for systems that remained exposed after disclosure; organisations should also conduct compromise assessment activities and review systems for indicators of malicious activity.
Where immediate patching is not possible, organisations may consider temporarily blocking access to the affected batch-processing endpoints using a web application firewall (WAF) or reverse proxy; this should be treated as a temporary mitigation rather than a replacement for applying vendor updates. Cloudflare has provided mitigations to address this exploit as a workaround.
Organisations should review logs for unusual POST requests targeting WordPress REST API endpoints, investigate newly installed or unauthorised plugins, identify recently created administrator accounts, and search for suspicious PHP files, particularly within the /wp-content/cache/ directory.
Additionally, administrators should review authentication and administrative activity for signs of compromise and investigate unusual outbound connections, persistence mechanisms, or other indicators that an attacker has established ongoing access following exploitation.
As organisations continue to focus on supply chain risks, identity compromise, and cloud security, incidents such as WP2Shell demonstrate that foundational security practices remain equally important - understanding where critical software is deployed and responding rapidly to security advisories remain essential controls. WP2Shell serves as a reminder that highly impactful vulnerabilities continue to emerge within widely deployed, internet-facing software, and that threat actors are increasingly capable of weaponising those vulnerabilities at speed.